CVE-2026-59792

In JetBrains IntelliJ IDEA before 2026.1.4, 2026.2 code execution via path traversal in project workspace ID handling was possible

CVSS v3 9.6 CRITICAL

9.6^/10

CVSS v3 : CRITICAL

Vector :

Exploitability : 2.8 / Impact : 6.0

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact LOW

Scope CHANGED

References

Link	Resource
https://www.jetbrains.com/privacy-security/issues-fixed/	Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:jetbrains:intellij_idea:*:*:*:*:*:*:*:*

History

24 Oct 2026, 23:10

Type	Values Removed	Values Added
Summary		(es) En JetBrains IntelliJ IDEA antes de 2026.1.4, la ejecución de código 2026.2 mediante salto de ruta en el manejo de ID del espacio de trabajo del proyecto era posible.

Information

Published : 2026-07-10 15:16

Updated : 2026-10-24 23:10

NVD link : CVE-2026-59792

Mitre link : CVE-2026-59792

CVE.ORG link : CVE-2026-59792

JSON object : View

Products Affected

jetbrains

intellij_idea

CWE

CWE-23

Relative Path Traversal

{"id": "CVE-2026-59792", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-59792", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-07-13T00:00:00+00:00"}}], "cvssMetricV31": [{"type": "Secondary", "source": "cve@jetbrains.com", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 9.6, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:L", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 6.0, "exploitabilityScore": 2.8}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 3.9}]}, "affected": [{"source": "cve@jetbrains.com", "affectedData": [{"vendor": "JetBrains", "product": "IntelliJ IDEA", "versions": [{"status": "affected", "version": "0", "lessThan": "2026.1.4, \n2026.2", "versionType": "semver"}], "defaultStatus": "unaffected"}]}], "published": "2026-07-10T15:16:48.240", "references": [{"url": "https://www.jetbrains.com/privacy-security/issues-fixed/", "tags": ["Vendor Advisory"], "source": "cve@jetbrains.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "cve@jetbrains.com", "description": [{"lang": "en", "value": "CWE-23"}]}], "descriptions": [{"lang": "en", "value": "In JetBrains IntelliJ IDEA before 2026.1.4, \n2026.2 code execution via path traversal in project workspace ID handling was possible"}, {"lang": "es", "value": "En JetBrains IntelliJ IDEA antes de 2026.1.4, la ejecuci\u00f3n de c\u00f3digo 2026.2 mediante salto de ruta en el manejo de ID del espacio de trabajo del proyecto era posible."}], "lastModified": "2026-10-24T23:10:00.160", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:jetbrains:intellij_idea:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "EFA3E4FD-FB82-4AE8-A702-C0BD219B88AC", "versionEndExcluding": "2026.1.4"}], "operator": "OR"}]}], "sourceIdentifier": "cve@jetbrains.com"}