CVE-2026-123858 · Package
NO FIX YET · SEE WHAT TO DO
In JetBrains PhpStorm before 2026.3, opening an untrusted project could automatically upload its project files to a configured deployment server. An attacker who supplies a malicious project can cause the IDE to push files to a server the developer has access to.
first public Nov 6, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Developers who use PhpStorm with deployment servers configured and who open projects from untrusted sources. Teams that only use PhpStorm on trusted code or without deployment configurations are less exposed. unknown for further detail.
Not affected if no-deployment-server, phpstorm-2026.3-or-later, trusted-projects-only
Who cares deployment, jetbrains, php, phpstorm
2026.3.2026.3 or later.In JetBrains PhpStorm before 2026.3 project files could be automatically uploaded to a deployment server from untrusted projects
This page as .md · .json · CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.