JetBrains PhpStorm versions prior to 2026.3 allowed the PHPMD ruleset autodetection feature to parse and process XML files from untrusted project directories. This parsing enabled XML External Entity (XXE) processing, potentially allowing a local attacker to read arbitrary files or retrieve sensitive data from the build environment. The weakness is identified as CWE‑611 and could lead to information disclosure if malicious XML is provided with an untrusted project file.

JetBrains PhpStorm, all releases before 2026.3 are affected. Users running any older version should verify that they are not using a successor build, as newer releases have disabled the unsafe autodetection logic.

The CVSS base score of 4.3 indicates a low‑moderate risk level. Because the vulnerability requires a user to open a malicious project in the IDE, the attack vector is local and does not involve network exploitation. EPSS is not available, and the vulnerability is not listed in the CISA KEV catalog, suggesting no publicly known exploitation at this time. Nonetheless, development teams that handle untrusted project files from external sources should be vigilant, as a local XXE could expose sensitive files such as configuration or credential data.