The vulnerability is a classic directory traversal flaw (CWE‑23) that occurs when IntelliJ IDEA unpacks Dev Container archives from a remote host without properly sanitizing file paths. An attacker could craft an archive containing paths that escape the intended destination, allowing files to be written outside the authorized container workspace or in system directories. This could lead to the disclosure of sensitive data, the introduction of malicious files, or the execution of arbitrary code if the overwritten files are critical to the IDE or underlying system.

JetBrains IntelliJ IDEA versions before 2026.3 are affected. The flaw is present in all edits of the product that support browsing and unpacking of Dev Container archives received from a remote host.

The CVSS score of 7.5 indicates a high severity. EPSS information is not available, and the flaw is not listed in the CISA KEV catalog. Based on the description, the likely attack path is that a remote host could send a specially crafted Dev Container archive to a user running IntelliJ IDEA, after which the IDE automatically unpacks it, enabling the attacker to place files in privileged locations. The absence of an active KEV listing suggests no widespread exploitation, but the high severity warrants rapid mitigation.