JetBrains IntelliJ IDEA Path Traversal Vulnerability Allowing Arbitrary File Read via Built-in Web Server

A vulnerability in JetBrains IntelliJ IDEA versions prior to 2024.3.7.1, 2025.1.7.1, 2025.2.6.2, 2025.3.4.1 and 2026.1.1 allows for arbitrary file reading. This issue arises from a path traversal vulnerability that can be exploited through the application's built-in web server.

Impact

Exploitation of this vulnerability could lead to unauthorized access to local files, potentially disclosing sensitive information.

Reproduction

To reproduce this vulnerability, start IntelliJ IDEA and open a project. Then, enable the built-in web server feature. Once the server is running, send a request that exploits the path traversal vulnerability to access arbitrary local files. This can be done by manipulating the request to include traversal sequences that bypass normal file access restrictions.

Remediation

Users can update to IntelliJ IDEA versions 2024.3.7.1, 2025.1.7.1, 2025.2.6.2, 2025.3.4.1 or 2026.1.1 to address this vulnerability.