CVE-2026-41882

Published: Apr 30, 2026Modified: Jun 17, 2026

7.5

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Exploitability: 3.9 / Impact: 3.6

Source: NVD

Description

In JetBrains IntelliJ IDEA before 2024.3.7.1, 2025.1.7.1, 2025.2.6.2, 2025.3.4.1, 2026.1.1 reading arbitrary local files was possible via built-in web server

Affected (5)

Products: Jetbrains: Intellij Idea

Jetbrains

1 product

Intellij Idea

Configuration A

5 vulnerable

Vulnerable Software	Affected Versions
Jetbrains Intellij Idea	Version 2024.3.7.1
Jetbrains Intellij Idea	Version 2025.1.7.1
Jetbrains Intellij Idea	Version 2025.2.6.2
Jetbrains Intellij Idea	Version 2025.3.4.1
Jetbrains Intellij Idea	Version 2026.1.1

Related CWEs

CWE-59

Improper Link Resolution Before File Access ('Link Following')

The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.

References (1)

https://www.jetbrains.com/privacy-security/issues-fixed/

Source: cve@jetbrains.com

Vendor Advisory

Timeline

No history available yet.