CVE-2026-123845 in IntelliJ IDEA
Summary
by MITRE • 11/06/2026
In JetBrains IntelliJ IDEA before 2026.3 path traversal was possible via JSON Schema references in untrusted projects
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 11/06/2026
The vulnerability identified as CVE-2024-XXXXX represents a critical security flaw within the JetBrains IntelliJ IDEA integrated development environment, specifically affecting versions prior to build 2026.3. This issue stems from an improper limitation on path traversal when processing JSON Schema references embedded within untrusted projects. In modern software development workflows, particularly those involving microservices or complex API definitions, developers frequently utilize JSON Schema files to define data structures and validate payloads. IntelliJ IDEA provides robust support for these schemas through its built-in editors and validation tools, allowing users to navigate between referenced schema files seamlessly. However, the underlying implementation failed to adequately sanitize file paths when resolving external references contained within a JSON document.
The technical root cause of this vulnerability lies in how the IDE resolves relative path references against the base URI of the current JSON Schema file. When an untrusted project is opened or loaded into the environment, the parser processes any $ref keywords that point to other files on the local filesystem. The flaw allows a malicious actor who controls the content of these schema files to specify paths containing directory traversal sequences such as dot-dot-slash (../). Because the IDE does not strictly validate whether the resolved path remains within the intended project boundaries or sandboxed area, it permits access to arbitrary locations on the host system's file structure. This behavior effectively bypasses standard isolation mechanisms designed to prevent code execution environments from accessing sensitive user data outside of their designated workspace.
From an operational perspective, this vulnerability poses a significant risk to developers who routinely open projects sourced from third parties or public repositories without rigorous vetting. An attacker could craft a malicious JSON Schema file that, when opened in the vulnerable version of IntelliJ IDEA, causes the application to read sensitive files such as configuration credentials, private keys, or source code belonging to other applications on the developer's machine. While this vulnerability is primarily classified as an information disclosure risk due to its ability to leak local filesystem contents, it could potentially serve as a stepping stone for more severe attacks if combined with other vulnerabilities in plugins or extensions that have higher privileges. The impact is exacerbated by the fact that developers often trust IDEs implicitly and may not anticipate file system access resulting from standard schema validation processes.
This flaw aligns closely with CWE-22, which defines Improper Limitation of a Pathname to a Restricted Directory, commonly known as path traversal or directory traversal. It also relates to CWE-94, specifically in contexts where the parsed content might lead to unintended code execution if combined with other injection vectors, though the primary manifestation here is unauthorized file access. In terms of the MITRE ATT&CK framework, this vulnerability facilitates reconnaissance and collection activities under techniques such as T1083 File and Directory Discovery or T1560 Archive Collected Data, depending on how an attacker leverages the extracted information to exfiltrate data from the victim's system.
Mitigation strategies for this issue are primarily focused on updating the development environment immediately. JetBrains has addressed this path traversal flaw in IntelliJ IDEA version 2026.3 and later releases by implementing stricter validation logic that ensures all resolved schema references remain within the project root directory or explicitly allowed safe zones. Organizations should enforce a policy of keeping IDEs updated to the latest stable versions to ensure these security patches are applied automatically during routine maintenance cycles. Additionally, developers should exercise caution when opening projects from untrusted sources, utilizing sandboxed environments like Docker containers or virtual machines for testing suspicious codebases until they can be verified as safe. Security teams should also consider implementing application control policies that restrict the execution of IDE components unless explicitly whitelisted, adding another layer of defense against exploitation attempts targeting local file system access.