{"id":"CVE-2026-123858","kind":"vulnerability","aliases":["CVE-2026-123858"],"related":[],"title":"JetBrains PhpStorm: untrusted projects can auto-upload files to deployment servers","description":"In JetBrains PhpStorm before 2026.3 project files could be automatically uploaded to a deployment server from untrusted projects","summary":"In JetBrains PhpStorm before 2026.3, opening an untrusted project could automatically upload its project files to a configured deployment server. An attacker who supplies a malicious project can cause the IDE to push files to a server the developer has access to.","severity":"medium","cvss":4.4,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["deployment","jetbrains","package","php","phpstorm"],"not_affected_if":["no-deployment-server","phpstorm-2026.3-or-later","trusted-projects-only"],"how_to_check":"- Check the installed PhpStorm version under Help > About and compare it with `2026.3`.\n- Review whether any deployment server is configured under Tools > Deployment.","fix":"- JetBrains PhpStorm: move to `2026.3` or later.","status":"open","published_at":"2026-11-06T17:17:25+00:00","first_seen_at":"2026-11-06T17:43:14+00:00","triaged_at":"2026-11-06T17:45:36+00:00","updated_at":"2026-11-06T17:45:36+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-06T17:45:36Z","model":"claude-haiku-5-5","output":{"fix":"- JetBrains PhpStorm: move to `2026.3` or later.","reach":"local","title":"JetBrains PhpStorm: untrusted projects can auto-upload files to deployment servers","impact":"medium","summary":"In JetBrains PhpStorm before 2026.3, opening an untrusted project could automatically upload its project files to a configured deployment server. An attacker who supplies a malicious project can cause the IDE to push files to a server the developer has access to.","audience":"developers","category":"package","nicknames":[],"who_cares":["phpstorm","jetbrains","php","deployment"],"confidence":0.6,"fix_status":"available","needs_auth":"no","worst_case":"project files uploaded to a deployment server without consent","analyst_note":"","how_to_check":"- Check the installed PhpStorm version under Help > About and compare it with `2026.3`.\n- Review whether any deployment server is configured under Tools > Deployment.\n- unknown for any further detail the sources do not give.","plain_action":"","needs_analyst":false,"not_affected_if":["phpstorm-2026.3-or-later","no-deployment-server","trusted-projects-only"],"who_is_affected":"Developers who use PhpStorm with deployment servers configured and who open projects from untrusted sources. Teams that only use PhpStorm on trusted code or without deployment configurations are less exposed. unknown for further detail.","user_interaction":"yes","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.000677,"input_tokens":4169,"output_tokens":521,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-123858':15A,18A '-2026':14A,17A '2026.3':28B,69C 'access':64B 'attack':45B 'auto':7A 'auto-upload':6A 'automat':34B,74C 'caus':52B 'configur':41B 'could':33B,72C 'cve':13A,16A 'deploy':11A,19B,42B,78C 'develop':62B 'file':9A,38B,57B,71C 'ide':54B 'jetbrain':1A,20B,25B,66C 'malici':49B 'open':29B 'packag':21B 'php':22B 'phpstorm':2A,23B,26B,67C 'project':4A,32B,37B,50B,70C,82C 'push':56B 'server':12A,43B,60B,79C 'suppli':47B 'untrust':3A,31B,81C 'upload':8A,35B,75C","nicknames":[],"mitigations":[],"who_affected":"Developers who use PhpStorm with deployment servers configured and who open projects from untrusted sources. Teams that only use PhpStorm on trusted code or without deployment configurations are less exposed. unknown for further detail.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":[],"ptokens":[],"labels":["deployment","jetbrains","medium","package","php","phpstorm"],"campaign_type":null,"search_a":"'-123858':15A,18A '-2026':14A,17A 'auto':7A 'auto-upload':6A 'cve':13A,16A 'deploy':11A 'file':9A 'jetbrain':1A 'phpstorm':2A 'project':4A 'server':12A 'untrust':3A 'upload':8A","search_b":"'2026.3':28B 'access':64B 'attack':45B 'automat':34B 'caus':52B 'configur':41B 'could':33B 'deploy':19B,42B 'develop':62B 'file':38B,57B 'ide':54B 'jetbrain':20B,25B 'malici':49B 'open':29B 'packag':21B 'php':22B 'phpstorm':23B,26B 'project':32B,37B,50B 'push':56B 'server':43B,60B 'suppli':47B 'untrust':31B 'upload':35B","search_c":"'2026.3':69C 'automat':74C 'could':72C 'deploy':78C 'file':71C 'jetbrain':66C 'phpstorm':67C 'project':70C,82C 'server':79C 'untrust':81C 'upload':75C","first_public_at":"2026-11-06T17:17:25+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N","cvss_by":"cve@jetbrains.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-123858","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-123858","severity":null,"published_at":"2026-11-06T17:17:25+00:00","modified_at":"2026-11-06T17:17:25+00:00","first_seen_at":"2026-11-06T17:43:14+00:00","fetched_at":"2026-11-06T17:43:14+00:00","note":null}],"documents":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}