CVE-2026-123858
MediumCVSS 4.4Exploitation Probability (EPSS)
Low risk4th percentile - higher than 4% of all known CVEs
Summary
In JetBrains PhpStorm before 2026.3, project files could be automatically uploaded to a deployment server from untrusted projects.
Risk Assessment
Opening an untrusted project may cause unexpected upload of files to a deployment server, risking data or code leakage.
Recommendation
Update JetBrains PhpStorm to version 2026.3 or later. Avoid opening untrusted projects until updated.
Other vulnerabilities in JetBrains PhpStorm
See all- CVE-2026-123857Medium
In JetBrains PhpStorm before 2026.3, XXE was possible in untrusted projects via PHPMD ruleset autodetection.
- CVE-2026-64809High
In JetBrains PhpStorm before 2026.2, arbitrary code execution was possible before granting project trust via the configured interpreter.
- CVE-2026-64808High
In JetBrains PhpStorm before 2026.2, arbitrary code execution was possible before granting project trust via project tooling.
Original NVD description (English source)
In JetBrains PhpStorm before 2026.3 project files could be automatically uploaded to a deployment server from untrusted projects
Vulnerability data from NVD (NIST) · CISA KEV · EPSS