Description

In JetBrains PhpStorm before 2026.3 project files could be automatically uploaded to a deployment server from untrusted projects

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.4",
  "pubDate": "2026-11-06T17:17:25.177Z",
  "pubdate": "2026-11-06T17:17:25.177Z",
  "executiveSummary": "This vulnerability involves an insecure configuration handling mechanism within JetBrains PhpStorm versions prior to 2026.3, allowing for unauthorized automated file synchronization.\nThe flaw stems from the application's failure to adequately sandbox or validate deployment configurations when processing untrusted project files.\nThe primary impact is the unintended, automated exfiltration or transmission of project data from a local environment to a remote deployment server.\nThis represents a significant supply chain and data security risk, particularly for developers who may open repositories from untrusted sources, such as those downloaded from third-party platforms or potentially malicious commit history.\nAn attacker can exploit this by crafting a project directory containing pre-configured deployment settings, which PhpStorm will interpret and execute upon loading the project.\nThe threat actor possesses the capability to influence the destination server of the project files, potentially leading to unauthorized disclosure of source code, sensitive environment variables, or other proprietary intellectual property.\nExploitation requires no elevated privileges on the host machine; the vulnerability is triggered automatically upon the user opening the malicious project directory in the IDE.",
  "technicalDetails": "The vulnerability resides in the project configuration parsing and deployment subsystem of JetBrains PhpStorm. The IDE utilizes project-specific configuration files (typically stored in the .idea directory) to manage server-side deployment mappings and synchronization triggers.\nThe root cause is the lack of a 'safe mode' or user-consent gate when the IDE detects existing deployment configurations within an imported project. When a project is loaded, the deployment component initializes and checks for configured 'Deployment Servers'. If these definitions exist, the IDE attempts to establish connectivity and synchronize the local files to the specified remote host as part of its automated deployment workflow.\nThe attack flow begins when an adversary distributes a malicious project directory containing a configured .idea/webServers.xml file (or equivalent deployment mapping configuration). This file contains hardcoded parameters, such as the remote host address, authentication credentials (if cached or improperly obfuscated), and path mappings.\nWhen a user opens this directory in an affected version of PhpStorm, the IDE identifies the project's deployment settings. The application fails to distinguish between trusted user-created configurations and configurations contained within untrusted external repositories. Consequently, the IDE automatically initiates the deployment process. If the remote host is reachable from the victim's network, the IDE proceeds to transmit project files to the attacker-controlled server via protocols such as SFTP, FTP, or FTPS.\nBecause the IDE treats these configurations as legitimate user settings, the synchronization occurs with the permissions of the current system user. This bypasses traditional perimeter defenses, as the connection originates from a trusted development environment. The post-exploitation impact includes the potential capture of sensitive data that is included in the project folder, including proprietary source code, configuration files, and potential hardcoded credentials that might be identified by the attacker once received at the remote endpoint.\nThis vulnerability is particularly dangerous because it requires zero interaction from the victim beyond the initial act of opening the project. It effectively turns the IDE into an automated exfiltration tool, leveraging existing functionality for a malicious objective. The vulnerability is present in all versions of PhpStorm released prior to 2026.3."
}