JetBrains has patched a critical path traversal vulnerability in IntelliJ IDEA that allows attackers to achieve arbitrary code execution simply by tricking a developer into opening a maliciously crafted project.
Tracked as CVE-2026-59792, the flaw carries a CVSS score of 9.6 and was disclosed on July 10, 2026, alongside a broader batch of security fixes covering IntelliJ IDEA and TeamCity.
The vulnerability stems from improper canonicalization of project workspace identifiers, allowing an attacker to embed “../” directory traversal sequences that bypass the IDE’s path validation logic.
Critical IntelliJ IDEA Path Traversal Flaw
Because IntelliJ IDEA processes workspace IDs before establishing project trust, a specially crafted project can write or execute files outside its intended sandboxed directory the moment it is opened, converting a routine “open project” action into full code execution on the developer’s machine.
Security researcher Antoni Tremblay is credited with reporting the issue under internal tracker IJPL-247564.
Notably, this flaw does not require any prior authentication or privilege on the target system, making it particularly dangerous in supply-chain-style attacks where malicious repositories or shared projects are distributed to developers.
The path traversal bug was disclosed as part of a larger JetBrains security update affecting both IntelliJ IDEA and TeamCity, spanning issues from HTML injection to authentication bypasses in remote development sessions.
JetBrains notes that while no active exploitation has been confirmed in the wild yet, the critical severity and ease of triggering the bug make rapid proof-of-concept development likely.
| Product | Vulnerability | Affected Version | CVE |
|---|---|---|---|
| IntelliJ IDEA | HTML injection in IDE notification enabling silent activity tracking (IJPL-247812) | 2026.2 | CVE-2026-64810 |
| IntelliJ IDEA | Arbitrary code execution before project trust granted, via dev container config (IJPL-245832) | 2026.2 | CVE-2026-64811 |
| IntelliJ IDEA | Unauthorized input injection in a Remote Development session (IJPL-245951) | 2026.2 | CVE-2026-64812 |
| IntelliJ IDEA | Unauthorized settings modification in a Remote Development session (IJPL-245849) | 2026.2 | CVE-2026-64813 |
| IntelliJ IDEA | Unauthorized file access in a Remote Development session (IJPL-245848) | 2026.2 | CVE-2026-64814 |
| IntelliJ IDEA | Arbitrary code injection via UI Designer form files (IDEA-387168) | 2026.2 | CVE-2026-64815 |
| IntelliJ IDEA | Code execution via path traversal in project workspace ID handling; reported by Antoni Tremblay (IJPL-247564) | 2026.1.4, 2026.2 | CVE-2026-59792 |
| TeamCity | Arbitrary file access via Perforce VCS integration; reported by @maple3142 (TW-101382) | 2026.1.2 | CVE-2026-59793 |
| TeamCity | Stored XSS on cloud profile page via agent-reported data (TW-101576) | 2026.1.2 | CVE-2026-59794 |
| TeamCity | Stored XSS via unauthenticated agent registration; reported by Joakim Bulow (TW-101494) | 2026.1.2 | CVE-2026-59795 |
| TeamCity | Pipeline modification via improper permission checks; reported by Alwion (TW-101629) | 2026.1.2 | CVE-2026-59796 |
Mitigation
JetBrains urges all developers to update IntelliJ IDEA to version 2026.1.4 or later, or 2026.2 with the latest patches applied, using the Toolbox App, built-in IDE updater, or direct download from the JetBrains website.
TeamCity administrators should similarly upgrade to 2026.1.2 or later to close the Perforce integration and XSS gaps.
Until patches are applied, organizations should treat unverified or third-party project files with caution and avoid opening them in vulnerable IDE versions, given how easily the workspace ID flaw can be triggered.
Cut SOC investigation blind spots and contain threats earlier to reduce response costs and business disruption with ANY.RUN.
