How severe is CVE-2021-25764?

CVE-2021-25764 has a CVSS 3.x base score of 5.3, rated medium severity. It is exploitable over network with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is none, integrity low, and availability none.

Is CVE-2021-25764 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 1% (51st percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2021-25764?

CVE-2021-25764 affects Jetbrains Phpstorm. See the affected-products list for the exact vulnerable versions.

How do I fix CVE-2021-25764?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.

When was CVE-2021-25764 published?

CVE-2021-25764 was published on 2021-03-18 and last updated on 2026-06-17.

CVE-2021-25764

CVE-2021-25764 is a medium-severity vulnerability in Jetbrains Phpstorm with a CVSS 3.x base score of 5.3. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low.

Key facts

Severity: Medium (CVSS 3.x base score 5.3)
CVSS v2: 5.0
EPSS exploit prediction: 1% (51st percentile)
Actively exploited: Not listed in CISA KEV
Affected product: Jetbrains Phpstorm
Published: 2021-03-18
Last modified: 2026-06-17

Description

In JetBrains PhpStorm before 2020.3, source code could be added to debug logs.

Frequently asked questions

What is CVE-2021-25764?: In JetBrains PhpStorm before 2020.3, source code could be added to debug logs.
How severe is CVE-2021-25764?: CVE-2021-25764 has a CVSS 3.x base score of 5.3, rated medium severity. It is exploitable over network with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is none, integrity low, and availability none.
Is CVE-2021-25764 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 1% (51st percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2021-25764?: CVE-2021-25764 affects Jetbrains Phpstorm. See the affected-products list for the exact vulnerable versions.
How do I fix CVE-2021-25764?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
When was CVE-2021-25764 published?: CVE-2021-25764 was published on 2021-03-18 and last updated on 2026-06-17.

References

Affected products (1)

cpe:2.3:a:jetbrains:phpstorm:*:*:*:*:*:*:*:*

More vulnerabilities in Jetbrains Phpstorm

CVE-2021-45977 — Critical (CVSS 9.8): JetBrains IntelliJ IDEA 2021.3.1 Preview, IntelliJ IDEA 2021.3.1 RC, PyCharm Professional 2021.3.1 RC, GoLand 2021.3.1,…
CVE-2024-37051 — Critical (CVSS 9.3): GitHub access token could be exposed to third-party sites in JetBrains IDEs after version 2023.1 and less than:…
CVE-2022-48435 — Low (CVSS 3.3): In JetBrains PhpStorm before 2023.1 source code could be logged in the local idea.log file

All CVEs affecting Jetbrains Phpstorm →