CVE-2026-59792: Critical Path Traversal in IntelliJ IDEA

CVE-2026-59792 is a critical (CVSS 9.6) flaw in JetBrains IntelliJ IDEA. Path traversal in project workspace ID handling allowed code execution. The record lists IntelliJ IDEA before 2026.1.4 and 2026.2 as affected. Update to 2026.1.4 or later, or the 2026.2 release, and confirm on the JetBrains page.

What's affected

• Product: JetBrains IntelliJ IDEA.
• Affected: before 2026.1.4, and the 2026.2 entry in the record. The record text reads "before 2026.1.4, 2026.2", so read the JetBrains fixed issues page to see the exact fixed build for the 2026.2 line.
• Weakness: CWE-23, relative path traversal. CVSS 9.6 (critical), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:L.
• The vector includes user interaction, so someone has to open or load something.

How to check if you're exposed

Check the installed version in the IDE under the About dialog, or from the command line on a machine with the IDE on the path.

# macOS example, adjust the app name to your install
defaults read "/Applications/IntelliJ IDEA.app/Contents/Info" CFBundleShortVersionString

For a fleet, ask your software inventory or endpoint tool for the IntelliJ IDEA version on each developer machine and any shared build or remote development host. The free in-browser scan at gold.safeguard.sh/scan covers dependencies in your projects. It does not inspect installed desktop tools, so use the vendor's own version display for those.

What to do now

1. List every machine that runs IntelliJ IDEA, including remote development hosts and CI images that bundle the IDE.
2. Update to 2026.1.4 or later on the 2026.1 line, or to the current 2026.2 build.
3. Confirm the exact fixed build on the JetBrains fixed security issues page.
4. Until updated, be careful about opening projects from sources you do not trust.

Why it matters

Path traversal means a path built from an outside value can step out of the folder it was meant to stay in. Here the weak spot is the handling of a project workspace ID. The record says that led to code execution, which is why the score is high and the scope is marked as changed.

Developer tools are an attractive target because developers hold source code, tokens and deploy access. The record's KEV flag is false, and I found no report of attacks in what I could read.

Quick check

Sources

• JetBrains fixed security issues page (listed in the record, but its entries did not load when I reviewed it)

Last reviewed: 19 October 2026.