CVE-2026-75058: 
JetBrains IntelliJ IDEA vulnerability analysis and mitigation

CVE-2026-75058 is an XML External Entity (XXE) injection vulnerability in JetBrains IntelliJ IDEA's Eclipse settings importer feature. It affects all versions of IntelliJ IDEA before 2026.2.1 and was published on August 17, 2026. The vulnerability allows a local, unprivileged user to read sensitive files from the system by tricking a victim into importing a maliciously crafted Eclipse settings file. It carries a CVSS v3.1 base score of 5.5 (Medium) (GitHub Advisory, JetBrains).

The root cause is improper restriction of XML External Entity references (CWE-611) in IntelliJ IDEA's Eclipse settings import functionality. When a user imports Eclipse settings, the XML parser processes the file without disabling external entity resolution, allowing an attacker-controlled XML file to reference and exfiltrate local file contents via XXE. Exploitation requires local access and user interaction — specifically, the victim must initiate an import of a malicious Eclipse settings file. No public proof-of-concept code has been identified at this time (GitHub Advisory, JetBrains).

Successful exploitation results in unauthorized disclosure of sensitive local files accessible to the IntelliJ IDEA process, such as configuration files, credentials, SSH keys, or other developer secrets. The confidentiality impact is rated High, while integrity and availability are unaffected. The attack scope is limited to the local system and does not directly enable lateral movement, but exposed credentials or keys could facilitate further compromise (GitHub Advisory).

There is no evidence of active in-the-wild exploitation or a publicly available proof-of-concept at this time. The EPSS score is 0.0, indicating very low probability of near-term exploitation. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation is not automatable and requires user interaction, limiting its practical attack surface (GitHub Advisory).

1. Craft malicious Eclipse settings file: Create an XML-based Eclipse settings file containing an XXE payload that references a sensitive local file, e.g., <!DOCTYPE foo [<!ENTITY xxe SYSTEM "file:///etc/passwd">]><settings>&xxe;</settings>.
2. Deliver the file to the target: Social-engineer the victim developer into receiving the malicious settings file, for example via a shared repository, email attachment, or internal file share.
3. Trigger import in IntelliJ IDEA: Instruct or wait for the victim to use IntelliJ IDEA's Eclipse settings import feature (File > Import Settings or similar) and select the malicious file.
4. Exfiltrate file contents: The XML parser resolves the external entity, embedding the contents of the referenced local file into the parsed output. Depending on the XXE variant used (e.g., out-of-band via HTTP), the attacker receives the file contents on a controlled server, or the data is surfaced in an error message or import result (GitHub Advisory).

• File System: Presence of unexpected or externally sourced Eclipse settings XML files (.epf or similar) in user directories or project folders containing DOCTYPE declarations or ENTITY references.
• Logs: IntelliJ IDEA logs (e.g., idea.log) showing XML parsing errors or unusual file access patterns during settings import operations.
• Network: Outbound HTTP/HTTPS connections from the IntelliJ IDEA process to unexpected external hosts immediately following a settings import action (indicative of out-of-band XXE exfiltration attempts).
• Process: IntelliJ IDEA process accessing sensitive files (e.g., /etc/passwd, SSH key files, .env files) outside of normal project directories during or after an import operation.

JetBrains has released a fix in IntelliJ IDEA version 2026.2.1. Users should update to this version or later as the primary remediation. As a temporary workaround, avoid importing Eclipse settings files from untrusted or unverified sources, and restrict local access to systems running affected versions. Developers should inspect any Eclipse settings files before importing them for suspicious XML constructs such as DOCTYPE or ENTITY declarations (JetBrains, GitHub Advisory).