CVE-2026-123857
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk17th percentile - higher than 17% of all known CVEs
Summary
In JetBrains PhpStorm before 2026.3, XXE was possible in untrusted projects via PHPMD ruleset autodetection.
Risk Assessment
Opening an untrusted project may allow an attacker to read local files or make network requests from the IDE, risking data leakage.
Recommendation
Update JetBrains PhpStorm to version 2026.3 or later. Avoid opening untrusted projects until updated.
Other vulnerabilities in JetBrains PhpStorm
See all- CVE-2026-123858Medium
In JetBrains PhpStorm before 2026.3, project files could be automatically uploaded to a deployment server from untrusted projects.
- CVE-2026-64809High
In JetBrains PhpStorm before 2026.2, arbitrary code execution was possible before granting project trust via the configured interpreter.
- CVE-2026-64808High
In JetBrains PhpStorm before 2026.2, arbitrary code execution was possible before granting project trust via project tooling.
Original NVD description (English source)
In JetBrains PhpStorm before 2026.3 xXE was possible in untrusted projects via PHPMD ruleset autodetection
Vulnerability data from NVD (NIST) · CISA KEV · EPSS