CVE-2026-41882

High

Published: 30 April 2026

Published

30 April 2026

Modified

05 May 2026

KEV Added

—

Patch

—

CVSS Score 7.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N

EPSS Score 0.0000 0.0th percentile

Risk Priority 15 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2026-41882 is a high-severity Link Following (CWE-59) vulnerability in Jetbrains Intellij Idea. Its CVSS base score is 7.4 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Data from Local System (T1005); ranked at the 0.0th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 CM-7 (Least Functionality) and SC-14 (Public Access Protections).

Threat & Defense at a Glance

What attackers do: exploitation maps to Data from Local System (T1005). What defenders deploy: see the NIST 800-53 controls recommended below.

Threat & Defense Details

Mitigating Controls (NIST 800-53 r5)AI

SI-2 Flaw Remediation good match

prevent

Directly mitigates the vulnerability by requiring timely patching of affected JetBrains IntelliJ IDEA versions to fix the improper file access check in the built-in web server.

CM-7 Least Functionality good match

prevent

Prevents exploitation by configuring the IDE to disable or restrict the unnecessary built-in web server functionality.

SC-14 Public Access Protections good match

prevent

Protects the publicly accessible built-in web server with safeguards to restrict unauthorized network access that could lead to arbitrary local file reads.

MITRE ATT&CK Enterprise TechniquesAI

T1005 Data from Local System Collection

Adversaries may search local system sources, such as file systems, configuration files, local databases, virtual machine files, or process memory, to find files of interest and sensitive data prior to Exfiltration.

attack.mitre.org →

Why these techniques?

The vulnerability directly enables arbitrary local file reads on the victim's system via the built-in web server, which maps to collecting data from local system sources such as files containing credentials or source code.

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1

NVD Description

In JetBrains IntelliJ IDEA before 2024.3.7.1, 2025.1.7.1, 2025.2.6.2, 2025.3.4.1, 2026.1.1 reading arbitrary local files was possible via built-in web server

Deeper analysisAI

CVE-2026-41882 affects JetBrains IntelliJ IDEA versions prior to 2024.3.7.1, 2025.1.7.1, 2025.2.6.2, 2025.3.4.1, and 2026.1.1. The vulnerability, published on 2026-04-30, enables reading arbitrary local files via the built-in web server and is classified under CWE-59 (Improper Link Resolution Before File Access Check). It carries a CVSS v3.1 base score of 7.4 (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N), indicating high severity due to significant confidentiality impact.

Attackers can exploit this vulnerability remotely over the network with low complexity and no required privileges, though user interaction is necessary, such as a victim accessing a crafted URL served by IntelliJ IDEA's built-in web server. Exploitation changes the attack scope and allows the attacker to read sensitive arbitrary local files on the victim's system, potentially exposing credentials, source code, or other confidential data without impacting integrity or availability.

JetBrains has released patches in the listed versions to mitigate the issue. Security practitioners should consult the advisory at https://www.jetbrains.com/privacy-security/issues-fixed/ for full details on affected versions, patch instructions, and verification steps.