JetBrains PhpStorm vulnerabilities

Latest JetBrains PhpStorm CVEs

Newest publication first

1. CVE-2026-123858 In JetBrains PhpStorm before 2026.3 project files could be automatically uploaded to a deployment server from untrusted projects

   Published 2026-11-06

   Medium·CVSS 4.4 EPSS 0.15%

   In JetBrains PhpStorm before 2026.3 project files could be automatically uploaded to a deployment server from untrusted projects

2. CVE-2026-123857 In JetBrains PhpStorm before 2026.3 xXE was possible in untrusted projects via PHPMD ruleset autodetection

   Published 2026-11-06

   Medium·CVSS 4.3 EPSS 0.26%

   In JetBrains PhpStorm before 2026.3 xXE was possible in untrusted projects via PHPMD ruleset autodetection

3. CVE-2026-118697 In JetBrains Toolbox App before 3.9.1 and 3.8.2; IntelliJ IDEA, PyCharm, PhpStorm, RubyMine, WebStorm, GoLand and Rider before 2026.3 and 2026.2.4; CLion before 2026.3 and 2026.2.4.1; DataGrip before....

   Published 2026-10-30

   Critical·CVSS 9.0 EPSS 0.29%

   In JetBrains Toolbox App before 3.9.1 and 3.8.2; IntelliJ IDEA, PyCharm, PhpStorm, RubyMine, WebStorm, GoLand and Rider before 2026.3 and 2026.2.4; CLion before 2026.3 and 2026.2.4.1; DataGrip before 2026.3 and 2026.2.6.1; RustRover before 2026.3 and 2026.2.5, the jetbrainsd daem...

4. CVE-2026-118696 In JetBrains IntelliJ IDEA, PyCharm, PhpStorm, RubyMine and WebStorm before 2026.3, 2026.2.4, 2026.1.5.1, and 2025.3.6.2; GoLand before 2026.3, 2026.2.4, 2026.1.5.1, and 2025.3.5.2; Rider before 2026....

   Published 2026-10-30

   High·CVSS 8.0 EPSS 0.27%

   In JetBrains IntelliJ IDEA, PyCharm, PhpStorm, RubyMine and WebStorm before 2026.3, 2026.2.4, 2026.1.5.1, and 2025.3.6.2; GoLand before 2026.3, 2026.2.4, 2026.1.5.1, and 2025.3.5.2; Rider before 2026.3, 2026.2.4, 2026.1.5.3, and 2025.3.5.3; CLion before 2026.3, 2026.2.4.1, 2026.1...

5. CVE-2026-64808 In JetBrains PhpStorm before 2026.2 arbitrary code execution was possible before granting project trust via project tooling

   Published 2026-07-23

   High·CVSS 8.4 EPSS 0.19%

   In JetBrains PhpStorm before 2026.2 arbitrary code execution was possible before granting project trust via project tooling

6. CVE-2026-64809 In JetBrains PhpStorm before 2026.2 arbitrary code execution was possible before granting project trust via the configured interpreter

   Published 2026-07-23

   High·CVSS 8.4 EPSS 0.19%

   In JetBrains PhpStorm before 2026.2 arbitrary code execution was possible before granting project trust via the configured interpreter

7. CVE-2024-37051 GitHub access token could be exposed to third-party sites in JetBrains IDEs after version 2023.1 and less than: IntelliJ IDEA 2023.1.7, 2023.2.7, 2023.3.7, 2024.1.3, 2024.2 EAP3; Aqua 2024.1.2; CLion....

   Published 2024-06-10

   High·CVSS 7.5 EPSS 4.9%

   GitHub access token could be exposed to third-party sites in JetBrains IDEs after version 2023.1 and less than: IntelliJ IDEA 2023.1.7, 2023.2.7, 2023.3.7, 2024.1.3, 2024.2 EAP3; Aqua 2024.1.2; CLion 2023.1.7, 2023.2.4, 2023.3.5, 2024.1.3, 2024.2 EAP2; DataGrip 2023.1.3, 2023.2.4...

8. CVE-2022-48435 In JetBrains PhpStorm before 2023.1 source code could be logged in the local idea.log file

   Published 2023-04-04

   Low·CVSS 3.3 EPSS 0.17%

   In JetBrains PhpStorm before 2023.1 source code could be logged in the local idea.log file

9. CVE-2021-45977 JetBrains IntelliJ IDEA 2021.3.1 Preview, IntelliJ IDEA 2021.3.1 RC, PyCharm Professional 2021.3.1 RC, GoLand 2021.3.1, PhpStorm 2021.3.1 Preview, PhpStorm 2021.3.1 RC, RubyMine 2021.3.1 Preview, Ruby...

   Published 2022-02-25

   Critical·CVSS 9.8 EPSS 1.1%

   JetBrains IntelliJ IDEA 2021.3.1 Preview, IntelliJ IDEA 2021.3.1 RC, PyCharm Professional 2021.3.1 RC, GoLand 2021.3.1, PhpStorm 2021.3.1 Preview, PhpStorm 2021.3.1 RC, RubyMine 2021.3.1 Preview, RubyMine 2021.3.1 RC, CLion 2021.3.1, WebStorm 2021.3.1 Preview, and WebStorm 2021.3...

10. CVE-2021-25764 In JetBrains PhpStorm before 2020.3, source code could be added to debug logs.

    Published 2021-03-18

    Medium·CVSS 5.3 EPSS 0.80%

    In JetBrains PhpStorm before 2020.3, source code could be added to debug logs.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.