Path traversal in IntelliJ IDEA - CVE-2026-123305
Published: November 6, 2026
Vulnerability identifier: #VU159671
CSH Severity: Medium
CVSS v4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-123305
CWE-ID: CWE-22
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to potentially write or overwrite files outside the intended archive extraction directory.
The vulnerability exists due to improper restriction of archive entry paths in IntelliJ IDEA's Dev Container archive extraction when unpacking archives from a remote host. A remote attacker can supply a crafted archive containing path traversal sequences to potentially write or overwrite files outside the intended extraction directory.
Affected software
IntelliJ IDEA
How to mitigate CVE-2026-123305
Install security update from vendor's website.
IntelliJ IDEA - update to 2026.3