{"id":"CVE-2026-123857","kind":"vulnerability","aliases":["CVE-2026-123857"],"related":[],"title":"JetBrains PhpStorm: untrusted projects can trigger XXE via PHPMD","description":"In JetBrains PhpStorm before 2026.3 xXE was possible in untrusted projects via PHPMD ruleset autodetection","summary":"In JetBrains PhpStorm before 2026.3, opening an untrusted project could trigger XML External Entity processing through PHPMD ruleset autodetection. An attacker who supplies a malicious project may be able to read local files or reach internal resources.","severity":"medium","cvss":4.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["jetbrains","other","php","phpstorm"],"not_affected_if":["phpstorm-2026.3-or-later","trusted-projects-only"],"how_to_check":"- Check the installed PhpStorm version under Help > About\n- Look for PhpStorm builds older than `2026.3`","fix":"- JetBrains PhpStorm: move to `2026.3` or later","status":"open","published_at":"2026-11-06T17:17:25+00:00","first_seen_at":"2026-11-06T17:43:13+00:00","triaged_at":"2026-11-06T17:45:37+00:00","updated_at":"2026-11-06T17:45:37+00:00","category":"other","confidence":0.6,"triage":{"at":"2026-11-06T17:45:37Z","model":"claude-haiku-5-5","output":{"fix":"- JetBrains PhpStorm: move to `2026.3` or later","reach":"local","title":"JetBrains PhpStorm: untrusted projects can trigger XXE via PHPMD","impact":"medium","summary":"In JetBrains PhpStorm before 2026.3, opening an untrusted project could trigger XML External Entity processing through PHPMD ruleset autodetection. An attacker who supplies a malicious project may be able to read local files or reach internal resources.","audience":"developers","category":"other","nicknames":[],"who_cares":["phpstorm","php","jetbrains"],"confidence":0.6,"fix_status":"available","needs_auth":"no","worst_case":"local files readable or internal resources reached via a crafted project","analyst_note":"","how_to_check":"- Check the installed PhpStorm version under Help > About\n- Look for PhpStorm builds older than `2026.3`\n- unknown for other checks","plain_action":"","needs_analyst":false,"not_affected_if":["trusted-projects-only","phpstorm-2026.3-or-later"],"who_is_affected":"Developers who open untrusted or third-party PHP projects in PhpStorm before 2026.3 with PHPMD ruleset autodetection in play. Teams that only open trusted, internal projects have much lower exposure. The sources do not say more about the exact trigger conditions.","user_interaction":"yes","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000673,"input_tokens":4180,"output_tokens":510,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-123857':12A,15A '-2026':11A,14A '2026.3':24B,61C 'abl':48B 'attack':40B 'autodetect':38B,71C 'could':29B 'cve':10A,13A 'entiti':33B 'extern':32B 'file':52B 'intern':55B 'jetbrain':1A,16B,21B,58C 'local':51B 'malici':44B 'may':46B 'open':25B 'php':18B 'phpmd':9A,36B,69C 'phpstorm':2A,19B,22B,59C 'possibl':64C 'process':34B 'project':4A,28B,45B,67C 'reach':54B 'read':50B 'resourc':56B 'ruleset':37B,70C 'suppli':42B 'trigger':6A,30B 'untrust':3A,27B,66C 'via':8A,68C 'xml':31B 'xxe':7A,62C","nicknames":[],"mitigations":[],"who_affected":"Developers who open untrusted or third-party PHP projects in PhpStorm before 2026.3 with PHPMD ruleset autodetection in play. Teams that only open trusted, internal projects have much lower exposure. The sources do not say more about the exact trigger conditions.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":[],"ptokens":[],"labels":["jetbrains","medium","other","php","phpstorm"],"campaign_type":null,"search_a":"'-123857':12A,15A '-2026':11A,14A 'cve':10A,13A 'jetbrain':1A 'phpmd':9A 'phpstorm':2A 'project':4A 'trigger':6A 'untrust':3A 'via':8A 'xxe':7A","search_b":"'2026.3':24B 'abl':48B 'attack':40B 'autodetect':38B 'could':29B 'entiti':33B 'extern':32B 'file':52B 'intern':55B 'jetbrain':16B,21B 'local':51B 'malici':44B 'may':46B 'open':25B 'php':18B 'phpmd':36B 'phpstorm':19B,22B 'process':34B 'project':28B,45B 'reach':54B 'read':50B 'resourc':56B 'ruleset':37B 'suppli':42B 'trigger':30B 'untrust':27B 'xml':31B","search_c":"'2026.3':61C 'autodetect':71C 'jetbrain':58C 'phpmd':69C 'phpstorm':59C 'possibl':64C 'project':67C 'ruleset':70C 'untrust':66C 'via':68C 'xxe':62C","first_public_at":"2026-11-06T17:17:25+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N","cvss_by":"cve@jetbrains.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-123857","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-123857","severity":null,"published_at":"2026-11-06T17:17:25+00:00","modified_at":"2026-11-06T17:17:25+00:00","first_seen_at":"2026-11-06T17:43:13+00:00","fetched_at":"2026-11-06T17:43:13+00:00","note":null}],"documents":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}