An attacker who controls the contents of an IntelliJ IDEA settings archive can place symlinked files to trick the IDE into resolving paths outside the intended directory, allowing the execution of arbitrary code during the import process. The flaw is classified as directory traversal (CWE-59) and can lead to full process compromise if the imported archive is executed with the same privileges as the IDE user. The impact is the ability to run arbitrary programs or scripts on the target system.

Clients using JetBrains IntelliJ IDEA versions earlier than 2026.3 are susceptible. Users who import settings archives—especially from untrusted sources—can trigger the vulnerability. The product is JetBrains IntelliJ IDEA, with affected builds identified only by the pre‑2026.3 release timeline.

The CVSS score of 7.8 denotes high severity. No EPSS score is published, so the current exploitation probability cannot be quantified, and the vulnerability is not listed in the CISA KEV catalog, indicating no publicly known exploits yet. The likely attack vector involves a local attacker or an adversary capable of inserting a malicious archive into a developer’s environment. The flaw can be exploited when the settings archive is processed by the IDE, allowing the attacker to traverse directories and execute any file they target.