CVE-2026-123305 in IntelliJ IDEA
Summary
by MITRE • 11/06/2026
In JetBrains IntelliJ IDEA before 2026.3 path traversal was possible via unpacking Dev Container archives from a remote host
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 11/06/2026
The vulnerability identified in versions of JetBrains IntelliJ IDEA prior to version 2026.3 represents a critical security flaw within the integrated development environment's handling of containerized project configurations, specifically concerning the extraction and processing of Development Container archives sourced from external or remote hosts. This issue stems from an insufficient validation mechanism applied when the IDE processes tarball files that define the runtime environment for a workspace. When developers utilize the Dev Containers feature to open projects hosted on remote repositories or shared network locations, the application accepts archive contents without adequately sanitizing file paths contained within the manifest and data layers of the package. This lack of rigorous path normalization allows an attacker who controls the content of such an archive to craft entries with maliciously constructed filenames that include directory traversal sequences, commonly known as dot-dot-slash patterns or their encoded equivalents.
From a technical perspective, this flaw is classified under CWE-22: Improper Limitation of a Pathname to a Restricted Directory. The core deficiency lies in the file system operations executed during the unpacking process. Instead of resolving the canonical path and ensuring it remains strictly within the designated temporary or project-specific directory structure intended for container artifacts, the software directly maps the extracted files based on the raw paths provided by the archive metadata. This behavior enables an adversary to write files outside the expected sandboxed environment. By carefully constructing a malicious Dev Container configuration file accompanied by an archive containing entries with relative path traversals pointing upwards from the root of the extraction directory, it is possible to overwrite or create arbitrary files in sensitive locations on the host operating system where IntelliJ IDEA is executing.
The operational impact of this vulnerability extends beyond simple data leakage and encompasses significant risks related to code injection and privilege escalation within the development workflow. If an attacker can successfully write a file into a location that is subsequently executed by the IDE, such as modifying configuration scripts or injecting malicious plugins, they could achieve arbitrary command execution on the developer's machine. This scenario aligns with ATT&CK technique T1059: Command and Scripting Interpreter, where the compromised development tool becomes an entry point for further exploitation. Furthermore, if the vulnerable version of IntelliJ IDEA is running with elevated privileges or accessing sensitive source code repositories, the attacker could potentially exfiltrate proprietary intellectual property by writing malicious scripts that trigger data transmission to external servers upon project load or build events.
Mitigation strategies primarily focus on immediate software updates and procedural safeguards until patches are fully deployed across all development environments. JetBrains has addressed this issue in version 2026.3, which implements stricter validation logic for archive contents during the unpacking phase. Developers must ensure their IDE is updated to this patched version or later to eliminate the path traversal vector entirely. In addition to updating software, organizations should enforce strict policies regarding the sources from which Dev Container configurations are imported. Relying on trusted internal repositories and verifying the integrity of external archives through cryptographic signatures can reduce the risk of encountering maliciously crafted container definitions. Security teams should also monitor for unusual file system activity in temporary directories associated with IDE operations as an indicator of potential exploitation attempts targeting unpatched instances.