CVE-2026-64808 is a vulnerability in JetBrains PhpStorm affecting versions prior to 2026.2. It involves improper enforcement of project trust, allowing arbitrary code execution through project tooling before the user grants trust to the project. The vulnerability is classified under CWE-829 (Inclusion of Functionality from Untrusted Control Sphere). The CVSS 3.1 base score is 8.4 with vector AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, indicating local attack vector with low complexity, no privileges required, no user interaction, and high impact on confidentiality, integrity, and availability. No patch or official remediation has been disclosed by the vendor as of the publication date.

Successful exploitation allows an attacker with local access to execute arbitrary code on the affected system before the user grants project trust, potentially leading to full compromise of confidentiality, integrity, and availability of the system running PhpStorm. This can result in unauthorized code execution and control over the development environment.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should exercise caution when opening untrusted projects and avoid running PhpStorm projects from unverified sources. Monitor JetBrains advisories for updates on patches or mitigations.