CVE-2026-64808 in PhpStorm
Summary
by MITRE • 07/23/2026
In JetBrains PhpStorm before 2026.2 arbitrary code execution was possible before granting project trust via project tooling
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 07/23/2026
This vulnerability in JetBrains PhpStorm prior to version 2026.2 represents a critical security flaw that allowed remote arbitrary code execution through untrusted project tooling components. The issue stems from the software's handling of project configuration files and external tool integrations that were executed without proper trust verification mechanisms. When users opened projects containing malicious tool configurations, the IDE would automatically execute these tools without requiring explicit user consent or project trust confirmation, creating an attack vector for remote code execution.
The technical implementation of this vulnerability involves the automatic execution of project-specific tooling configurations that are typically defined in project metadata files such as .idea/tooling.xml or similar configuration structures. These configurations often include external command invocations, script executions, or integration with third-party tools that can be manipulated by attackers to execute malicious payloads. The flaw exists because PhpStorm's trust model failed to properly validate whether these tooling components originated from trusted sources or had been tampered with during project transfer or repository cloning operations.
From an operational perspective this vulnerability poses significant risk to developers who frequently work with external projects or collaborate through version control systems where malicious actors could inject harmful tool configurations into project repositories. The impact extends beyond individual developer machines to enterprise environments where shared development practices and automated build processes might inadvertently execute malicious code. Attackers could leverage this vulnerability by creating specially crafted project files that contain malicious tool definitions, which would then be executed when developers open such projects in PhpStorm.
The vulnerability aligns with CWE-494, which describes the risk of downloading code from untrusted sources without proper validation and verification. It also maps to ATT&CK technique T1059.007 for execution through scripting languages and T1203 for exploitation of software vulnerabilities. Organizations should implement immediate mitigations including updating to PhpStorm version 2026.2 or later, enabling secure project trust mechanisms, and establishing code review processes for project configurations. Additionally, developers should be trained to avoid opening untrusted projects without proper verification, and organizations should consider implementing automated scanning solutions that can detect malicious tooling configurations in project metadata files.