JetBrains IntelliJ IDEA versions earlier than 2026.3 allow an attacker to write arbitrary files by exploiting symbolic links during the extraction of plugin archives. The flaw arises from the fact that when the IDE unpacks an archive, it follows symlinks without properly validating the target path, permitting malicious content to overwrite arbitrary files on the file system. This weakness can compromise the confidentiality, integrity, and availability of the system depending on the write location, and is related to CWE‑59.

The vulnerability affects JetBrains IntelliJ IDEA prior to version 2026.3. Users running any version before the 2026.3 update should be aware of this flaw, especially if they install plugins from untrusted sources or manually extract plugin archives.

The CVSS score of 7.1 indicates medium to high severity. Because the exploit requires access to the plugin archive extraction process, the likely attack vector is a user or an automated process installing or unpacking a malicious plugin. No EPSS score is available, and the vulnerability is not listed in the CISA KEV catalog, suggesting limited known exploitation. Nevertheless, the ability to write files arbitrarily can lead to code execution or privilege escalation if critical system files are targeted.