CVE-2026-59792

CriticalCVSS 9.8/10Last modified Oct 24, 2026

Description

In JetBrains IntelliJ IDEA before 2026.1.4, 2026.2 code execution via path traversal in project workspace ID handling was possible

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-23

Affected software

No affected versions have been published.

Timeline

Published
Jul 10, 2026
Last modified
Oct 24, 2026
NVD status
Analyzed

Related CVEs from 2026

CVE-2026-597938.8In JetBrains TeamCity before 2026.1.2 arbitrary file access was possible via the Perforce VCS integrationCVE-2026-597945.4In JetBrains TeamCity before 2026.1.2 stored XSS on the cloud profile page was possible via agent-reported dataCVE-2026-597956.1In JetBrains TeamCity before 2026.1.2 stored XSS via unauthenticated agent registration was possibleCVE-2026-597968.1In JetBrains TeamCity before 2026.1.2 pipeline modification was possible due to improper permission checksCVE-2026-597979.8Improper Privilege Management vulnerability in Apache HTTP Server's mod_ssl via SSLRequire and file-related expressions. This issue affecCVE-2026-597998.8Improper Privilege Management vulnerability in Apache CloudStack's Two-factor authentication plugin allowing bypass of the two-factor authenCVE-2026-59808.8A flaw has been found in D-Link DIR-605L 2.13B01. Affected by this issue is the function formSetMACFilter of the file /goform/formSetMACFiltCVE-2026-598009.89Router before 0.4.44 contains an OS command injection vulnerability in the unauthenticated POST /api/tunnel/tailscale-install endpoint (thiCVE-2026-598019.89Router through version 0.4.41 contains an unauthenticated access vulnerability that allows remote attackers to interact with provider managCVE-2026-598028.2PasswordPusher before 2.8.1 accepts data URI schemes in URL push payloads due to insufficient validation in the valid_url function. AttackerCVE-2026-598037.5rpcx through 1.9.3, fixed in commit 047aec1, contains a denial-of-service vulnerability in protocol.Message.Decode (protocol/message.go). WhCVE-2026-598046.8Midscene Bridge Server through 1.10.3, fixed in commit 86f4118, contains a missing authentication and CORS misconfiguration vulnerability th