JetBrains PhpStorm versions prior to 2026.3 will automatically upload project files to a connected deployment server when the project is considered untrusted. This behavior enables an attacker who can place a malicious or otherwise sensitive project file in the local workspace to have its contents transferred to the deployment target without the user’s explicit action or permission. The result is a potential disclosure of confidential project data to the deployment environment, which could then be accessed by other users with privileges on that server. The vulnerability is a form of improper restriction of operations (CWE‑829) as the application grants upload rights to untrusted input.

The issue affects the JetBrains PhpStorm IDE for all releases earlier than 2026.3. Administrators of installations using any pre‑2026.3 edition should verify that auto‑upload settings are disabled or that deployment servers are properly secured, as any project file may be transmitted without the user’s consent.

The CVSS score of 4.4 classifies this flaw as moderate; the EPSS score is not available, and the vulnerability is not listed in CISA’s KEV catalog, indicating limited current exploitation evidence. Nevertheless, since the action is automated by the IDE, the attack vector is internal to the user’s machine and requires no remote code execution. An attacker with access to a victim’s local workspace can create a project file that will be sent to the deployment server, potentially exposing data to other stakeholders with access to that server. The lack of a known exploit and the moderate severity suggest immediate attention, but it is unlikely to be widely leveraged as a critical threat.