CVE-2026-123858: Security vulnerability

Published Nov 6, 2026

Updated

In JetBrains PhpStorm before 2026.3 project files could be automatically uploaded to a deployment server from untrusted projects

Event History

Nov 6, 2026

CVE Published

via MITRE·04:10 PM

Data Sourced

via MITRE·04:10 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·05:17 PM

DescriptionSeverityWeakness

Frequently Asked Questions

What user interaction is required for exploitation?

A user must open an untrusted project in an affected PhpStorm version. The issue involves project files being automatically uploaded to a deployment server.

Which systems should be prioritized for remediation?

Prioritize PhpStorm installations earlier than 2026.3 that are used to open projects from untrusted sources, particularly where deployment servers are configured.

How can I determine whether an installation is affected?

An installation is affected if it runs a PhpStorm version before 2026.3. Updating to 2026.3 or later addresses the affected version range.

CVE-2026-123858: Security vulnerability

Event History

Frequently Asked Questions

What user interaction is required for exploitation?

Which systems should be prioritized for remediation?

How can I determine whether an installation is affected?

Company

Resources

Contact

Frequently Asked Questions

What user interaction is required for exploitation?

Which systems should be prioritized for remediation?

How can I determine whether an installation is affected?