The vulnerability allows the Hadoop ResourceManager component of JetBrains IntelliJ IDEA to process XML documents containing external entity declarations that resolve to local files. Attackers can craft a malicious XML payload which, when parsed, causes the application to read arbitrary files on the host machine. This flaw aligns with CWE‑611, enabling information disclosure of files that may contain sensitive data.

The issue affects all releases of JetBrains IntelliJ IDEA prior to version 2026.2.1 that include the Hadoop ResourceManager feature. Systems running these versions are susceptible whenever an XML file that is processed by the ResourceManager is supplied by a user or an adjacent component that can influence the XML content.

The CVSS score of 5.5 indicates moderate severity. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. The attack vector is inferred to be local or remote, depending on who can supply the XML payload; the flaw requires the attacker to provide or influence XML input to a running instance of the ResourceManager. While the vulnerability does not grant code execution, it can expose confidential files and compromise system information integrity.