CVE-2025-57728
📋 TL;DR
This vulnerability in JetBrains IntelliJ IDEA allows Code With Me guests to discover hidden files on the host system due to improper access control. It affects developers using IntelliJ IDEA's collaborative coding feature. The risk is limited to file discovery rather than modification or exfiltration.
💻 Affected Systems
- JetBrains IntelliJ IDEA
📦 What is this software?
Intellij Idea by Jetbrains
⚠️ Risk & Real-World Impact
Worst Case
Guest users could discover sensitive hidden files containing credentials, configuration secrets, or proprietary source code, potentially leading to further attacks.
Likely Case
Guests accidentally or intentionally discovering hidden project configuration files, temporary files, or IDE settings that weren't meant to be shared.
If Mitigated
Limited exposure of non-critical hidden files with minimal security impact.
🎯 Exploit Status
Requires guest access to a Code With Me session. No authentication bypass needed beyond being invited as a guest.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 2025.2 or later
Vendor Advisory: https://www.jetbrains.com/privacy-security/issues-fixed/
Restart Required: No
Instructions:
1. Open IntelliJ IDEA. 2. Go to Help > Check for Updates. 3. Install version 2025.2 or newer. 4. The update applies automatically without restart.
🔧 Temporary Workarounds
Disable Code With Me
allTemporarily disable the Code With Me feature to prevent exploitation
Go to Settings/Preferences > Tools > Code With Me and disable the feature
Restrict Guest Permissions
allLimit guest permissions to read-only for specific files only
When starting Code With Me session, set guest permissions to minimal access
🧯 If You Can't Patch
- Avoid using Code With Me with untrusted guests
- Ensure no sensitive hidden files exist in shared project directories
🔍 How to Verify
Check if Vulnerable:
Check IntelliJ IDEA version in Help > About. If version is below 2025.2 and Code With Me is enabled, system is vulnerable.Check Version:
Help > About in IntelliJ IDEA GUI (no CLI command available)Verify Fix Applied:
Verify version is 2025.2 or newer in Help > About. Test Code With Me session to confirm hidden files are not accessible to guests.📡 Detection & Monitoring
Log Indicators:
- Unusual file access patterns in Code With Me session logs
- Multiple hidden file access attempts by guest users
Network Indicators:
- Code With Me session traffic showing file enumeration patterns
SIEM Query:
source="intellij" AND "Code With Me" AND ("hidden" OR "." file_access)