CVE-2026-59792: JetBrains IntelliJ IDEA Path Traversal

CVE-2026-59792 Overview

CVE-2026-59792 is a path traversal vulnerability in JetBrains IntelliJ IDEA that enables remote code execution. The flaw resides in project workspace ID handling, where insufficient validation of directory separators allows attackers to escape the intended workspace directory. Successful exploitation lets attackers write or reference files outside the workspace boundary, resulting in arbitrary code execution in the context of the IDE user. The vulnerability affects IntelliJ IDEA versions before 2026.1.4 and 2026.2. JetBrains has published a fix through its security advisory portal.

Critical Impact
Remote attackers can achieve code execution on developer workstations by supplying a crafted project workspace ID that traverses outside the intended directory.

Affected Products

JetBrains IntelliJ IDEA versions prior to 2026.1.4
JetBrains IntelliJ IDEA 2026.2 (pre-fix)
All platforms running vulnerable IntelliJ IDEA builds (Windows, macOS, Linux)

Discovery Timeline

2026-07-10 - CVE-2026-59792 published to NVD
2026-07-14 - Last updated in NVD database

Technical Details for CVE-2026-59792

Vulnerability Analysis

The vulnerability is classified as a relative path traversal issue [CWE-23] in the code path responsible for handling project workspace identifiers. IntelliJ IDEA uses workspace IDs to map project state, cached indexes, and configuration files to on-disk locations. When the workspace ID contains traversal sequences such as ../, the resolver builds a filesystem path that escapes the intended base directory. Attackers can leverage this behavior to write, overwrite, or reference files at arbitrary locations reachable by the IDE process, leading to code execution.

Root Cause

The root cause is missing canonicalization and validation of the workspace ID before it is concatenated into a filesystem path. The affected code treats the workspace ID as trusted input and does not enforce that the resolved path remains inside the workspace root. Because IntelliJ IDEA loads and executes content from workspace-controlled files during project open and indexing operations, writing attacker-controlled data into an unexpected location translates directly into code execution.

Attack Vector

Exploitation is network-reachable and requires no authentication or user interaction beyond opening or importing a crafted project. An attacker distributes a project, repository, or workspace descriptor containing a malicious workspace ID. When IntelliJ IDEA processes the ID, the traversal payload places attacker-controlled content into a location that the IDE later loads, such as a plugin, startup script, or auto-executed configuration file. The result is arbitrary code execution under the developer's account.

No public proof-of-concept is available. Refer to the JetBrains Fixed Security Issues advisory for vendor guidance.

Detection Methods for CVE-2026-59792

Indicators of Compromise

Files created or modified outside the standard IntelliJ IDEA workspace directory (.idea/, system/, config/) that correspond in time to project open events.
Presence of ../ or encoded traversal sequences inside workspace ID fields of project metadata files.
Unexpected child processes spawned from the IntelliJ IDEA process (idea64.exe, idea, idea.sh) shortly after opening a new project.

Detection Strategies

Inspect project files from untrusted sources for workspace ID values containing directory separators or traversal tokens before opening them in the IDE.
Hunt on developer endpoints for IntelliJ IDEA writing to paths outside its standard configuration and cache directories.
Correlate IDE launch events with subsequent shell, PowerShell, or scripting engine executions that lack a legitimate build or run configuration source.

Monitoring Recommendations

Enable file integrity monitoring on IntelliJ IDEA configuration, plugin, and startup script directories under the user profile.
Log and alert on process ancestry where IntelliJ IDEA is the parent of interpreters or system binaries such as cmd.exe, bash, or python.
Track version telemetry across developer fleets to identify IntelliJ IDEA installs still on builds prior to 2026.1.4.

How to Mitigate CVE-2026-59792

Immediate Actions Required

Upgrade IntelliJ IDEA to version 2026.1.4 or the patched 2026.2 build listed in the JetBrains advisory.
Restrict developers from opening projects sourced from untrusted repositories, archives, or shared drives until patching is complete.
Audit existing project directories for workspace ID values that contain path traversal sequences and quarantine any suspicious projects.

Patch Information

JetBrains has released fixed builds addressing the path traversal in workspace ID handling. Apply IntelliJ IDEA 2026.1.4 or the corresponding patched 2026.2 release. Refer to the JetBrains Fixed Security Issues page for exact build numbers and download links. Deploy updates through JetBrains Toolbox, enterprise software distribution, or the built-in updater.

Workarounds

Only open projects originating from trusted, code-reviewed sources until the update is deployed.
Run IntelliJ IDEA under a standard user account with no local administrator privileges to limit post-exploitation impact.
Enforce endpoint application allowlisting to prevent unexpected child processes from executing under the IDE.

bash

# Verify installed IntelliJ IDEA version on Linux/macOS
/Applications/IntelliJ\ IDEA.app/Contents/MacOS/idea --version
idea.sh --version

# Windows: query installed version
(Get-Item "C:\Program Files\JetBrains\IntelliJ IDEA*\bin\idea64.exe").VersionInfo.ProductVersion