SB2026050548 - Multiple vulnerabilities in IntelliJ IDEA

Description

This security bulletin contains information about 3 vulnerabilities.

1) Link following (CVE-ID: CVE-2026-41882)

CWE-ID: CWE-59 - Improper Link Resolution Before File Access ('Link Following')

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to disclose arbitrary local files.

The vulnerability exists due to improper link resolution in built-in web server when handling requests. A remote user can send a specially crafted request to disclose arbitrary local files.

2) Command injection (CVE-ID: CVE-2026-49366)

CWE-ID: CWE-77 - Command injection

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to execute arbitrary commands.

The vulnerability exists due to command injection in filename completion when processing a crafted filename. A local user can supply a specially crafted filename to execute arbitrary commands.

3) Missing Authorization (CVE-ID: CVE-2026-49367)

CWE-ID: CWE-862 - Missing Authorization

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to execute arbitrary commands.

The vulnerability exists due to improper authorization in the guest user account when accessing the application. A remote user can use the guest user account to execute arbitrary commands.

Remediation

Install update from vendor's website.

References

• https://www.jetbrains.com/privacy-security/issues-fixed/#74b169ebce1f951cbe2256554212084d
• https://www.jetbrains.com/privacy-security/issues-fixed/#f1f0c050ac9c6fd57ca3e5a9deff8829
• https://www.jetbrains.com/privacy-security/issues-fixed/#7da600363a54589879588b8f3120350f