Technical impact
The flaw enables an attacker to read arbitrary local files through JetBrains IntelliJ IDEA’s built‑in web server, which fails to validate file paths and serves content without proper restrictions; this allows disclosure of source code, configuration files, or other sensitive data, compromising confidentiality; the weakness is classified as CWE‑59.
Affected Systems
IntelliJ IDEA versions 2024.3.7.1, 2025.1.7.1, 2025.2.6.2, 2025.3.4.1, and 2026.1.1 are affected when the built‑in web server is active or exposed to a network; previous releases and later patched versions are not vulnerable.
Risk and Exploitability
The CVSS score of 7.4 signals a high‑severity flaw, yet the EPSS score is below 1%, indicating a low probability of exploitation. The vulnerability is not listed in CISA’s KEV catalog. Based on the description, it is inferred that the likely attack vector involves an attacker sending a crafted request to the built‑in web server after it is exposed to a network or when a user or attacker forces a local request that resolves to an arbitrary file path, which the IDE then serves as plain text. This scenario would mainly affect internal threat actors or individuals who can trick users into directing the IDE’s web server to an adversary‑controlled address, making it most relevant to local or insider threats.
