CVE-2026-123845: Path Traversal

Published Nov 6, 2026

Updated

In JetBrains IntelliJ IDEA before 2026.3 path traversal was possible via JSON Schema references in untrusted projects

Event History

Nov 6, 2026

CVE Published

via MITRE·04:10 PM

Data Sourced

via MITRE·04:10 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·05:17 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which users are realistically exposed?

Users of JetBrains IntelliJ IDEA versions before 2026.3 are exposed when they open or work with untrusted projects that include JSON Schema references.

What does an attacker need to exploit this issue?

An attacker needs to provide an untrusted project containing JSON Schema references crafted to trigger path traversal. The available information does not indicate that exploitation can occur without interaction with such a project.

What version fixes the issue?

The issue affects IntelliJ IDEA releases before 2026.3. Updating to 2026.3 or a later release removes the affected version range described in the advisory.

CVE-2026-123845: Path Traversal

Event History

Frequently Asked Questions

Which users are realistically exposed?

What does an attacker need to exploit this issue?

What version fixes the issue?

Company

Resources

Contact

Frequently Asked Questions

Which users are realistically exposed?

What does an attacker need to exploit this issue?

What version fixes the issue?