Arbitrary Code Execution in JetBrains PhpStorm Affects User Trust Setting
CVE-2026-64809

8.4HIGH

Key Information:

Vendor

Jetbrains
Status
PHPstorm
Vendor
CVE Published:
23 July 2026

What is CVE-2026-64809?

A vulnerability in JetBrains PhpStorm allows arbitrary code execution before project trust is granted via the configured interpreter. This occurs in versions prior to 2026.2, exposing users to potential risks if untrusted code is executed without appropriate safeguards.

Affected Version(s)

PhpStorm 0 < 2026.2

References

https://www.jetbrains.com/privacy-security/issues-fixed/

CVSS V3.1

Score:
8.4
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.