JetBrains PhpStorm vulnerabilities

4 known CVE vulnerabilities in JetBrains PhpStorm, translated and rated.

CVE-2026-123858Medium
In JetBrains PhpStorm before 2026.3, project files could be automatically uploaded to a deployment server from untrusted projects.
CVE-2026-123857Medium
In JetBrains PhpStorm before 2026.3, XXE was possible in untrusted projects via PHPMD ruleset autodetection.
CVE-2026-64809High
In JetBrains PhpStorm before 2026.2, arbitrary code execution was possible before granting project trust via the configured interpreter.
CVE-2026-64808High
In JetBrains PhpStorm before 2026.2, arbitrary code execution was possible before granting project trust via project tooling.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS