Skip to content
fr Sign in
7.5 High

CVE-2026-12609 In Eclipse Theia versions 1.66.0 and up until including 1.73.1, the `@theia/plugin-ext` backend exposes the…

Description

In Eclipse Theia versions 1.66.0 and up until including 1.73.1, the `@theia/plugin-ext` backend exposes the `/hostedPlugin/:pluginId/:path(*)` HTTP endpoint, which resolves the requested file path with `path.resolve(localPath, filePath)` without verifying that the resolved path stays within the plugin's directory. An unauthenticated network attacker can send percent-encoded `../` sequences (`%2e%2e%2f`) that decode into the path parameter and escape the plugin directory, allowing arbitrary files readable by the Theia backend process to be retrieved. Plugin IDs are derived deterministically from a plugin's publisher and name, so built-in plugins serve as reliable anchors that require no prior knowledge of the target system.

Affected products and versions

Product Affected versions Fixed in
Eclipse Theia 1.66 1.66.0 → < 1.74.0 1.74.0

References

Timeline

  1. Published
  2. Last modified

Other CVEs of Eclipse Theia

The 12 CVEs of Eclipse Theia →
CVE-2026-82217 In Eclipse Theia versions 1.73.0 up to but not including 1.75.0, the AI "Agent Mode" file-change tools… 8.8 High CVE-2026-19884 In Eclipse Theia versions up to and including 1.69.0, opening a folder starts source control integration without… 8.4 High CVE-2026-61891 In Eclipse Theia versions up to and including 1.73.1, the `@theia/filesystem` backend exposes HTTP file-download… 7.5 High CVE-2026-60009 In Eclipse Theia versions up to and including 1.73.1, the `@theia/filesystem` backend binds `POST /file-upload` in every… 8.8 High
Track this CVE