Medium · 4.3 CVE-2026-123857 EUVD-2026-118317GHSA-x28h-qvqp-4h33

In JetBrains PhpStorm before 2026.3 xXE was possible in untrusted projects via PHPMD ruleset autodetection

Published Nov 6, 2026 · Updated Nov 6, 2026 · Assigned by JetBrains

Vendor: JetBrains Product: PhpStorm

Description

In JetBrains PhpStorm before 2026.3 xXE was possible in untrusted projects via PHPMD ruleset autodetection

Affected products

Vendor	Product	Affected	Fixed
JetBrains	PhpStorm	< 2026.3	2026.3

Advisories 1

WID-SEC-2026-4397 JetBrains PhpStorm: Mehrere Schwachstellen BSI CERT-Bund (WID) · Nov 8, 2026

References

https://www.jetbrains.com/privacy-security/issues-fixed/