CVE-2026-111093

Published: Oct 15, 2026Modified: Oct 15, 2026

7.5

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Exploitability: 3.9 / Impact: 3.6

Source: cve@jetbrains.com (Secondary)

Description

In JetBrains Datalore before 2026.2.1 unauthenticated path traversal via the report blob endpoint allowed reading arbitrary files

Related CWEs

Relative Path Traversal

The product uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize sequences such as ".." that can resolve to a location that is outside of that directory.

References (1)

https://www.jetbrains.com/privacy-security/issues-fixed/

Source: cve@jetbrains.com

Timeline

No history available yet.