CVE-2026-41882
Published: 30 April 2026
Summary
CVE-2026-41882 is a high-severity Link Following (CWE-59) vulnerability in Jetbrains Intellij Idea. Its CVSS base score is 7.4 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Data from Local System (T1005); ranked at the 0.0th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 CM-7 (Least Functionality) and SC-14 (Public Access Protections).
Deeper analysis
CVE-2026-41882 affects JetBrains IntelliJ IDEA versions prior to 2024.3.7.1, 2025.1.7.1, 2025.2.6.2, 2025.3.4.1, and 2026.1.1. The vulnerability, published on 2026-04-30, enables reading arbitrary local files via the built-in web server and is classified under CWE-59 (Improper Link Resolution Before File Access Check). It carries a CVSS v3.1 base score of 7.4 (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N), indicating high severity due to significant confidentiality impact.
Attackers can exploit this vulnerability remotely over the network with low complexity and no required privileges, though user interaction is necessary, such as a victim accessing a crafted URL served by IntelliJ IDEA's built-in web server. Exploitation changes the attack scope and allows the attacker to read sensitive arbitrary local files on the victim's system, potentially exposing credentials, source code, or other confidential data without impacting integrity or availability.
JetBrains has released patches in the listed versions to mitigate the issue. Security practitioners should consult the advisory at https://www.jetbrains.com/privacy-security/issues-fixed/ for full details on affected versions, patch instructions, and verification steps.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-26368
Vulnerability details
In JetBrains IntelliJ IDEA before 2024.3.7.1, 2025.1.7.1, 2025.2.6.2, 2025.3.4.1, 2026.1.1 reading arbitrary local files was possible via built-in web server
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The vulnerability directly enables arbitrary local file reads on the victim's system via the built-in web server, which maps to collecting data from local system sources such as files containing credentials or source code.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly mitigates the vulnerability by requiring timely patching of affected JetBrains IntelliJ IDEA versions to fix the improper file access check in the built-in web server.
Prevents exploitation by configuring the IDE to disable or restrict the unnecessary built-in web server functionality.
Protects the publicly accessible built-in web server with safeguards to restrict unauthorized network access that could lead to arbitrary local file reads.