Aller au contenu
en Se connecter
7.5 Élevée

CVE-2026-12609 In Eclipse Theia versions 1.66.0 and up until including 1.73.1, the `@theia/plugin-ext` backend exposes the…

Description

In Eclipse Theia versions 1.66.0 and up until including 1.73.1, the `@theia/plugin-ext` backend exposes the `/hostedPlugin/:pluginId/:path(*)` HTTP endpoint, which resolves the requested file path with `path.resolve(localPath, filePath)` without verifying that the resolved path stays within the plugin's directory. An unauthenticated network attacker can send percent-encoded `../` sequences (`%2e%2e%2f`) that decode into the path parameter and escape the plugin directory, allowing arbitrary files readable by the Theia backend process to be retrieved. Plugin IDs are derived deterministically from a plugin's publisher and name, so built-in plugins serve as reliable anchors that require no prior knowledge of the target system.

Produits et versions touchés

Produit Versions touchées Corrigé en
Eclipse Theia 1.66 1.66.0 → < 1.74.0 1.74.0

Références

Chronologie

  1. Publiée
  2. Dernière modification

Autres CVE de Eclipse Theia

Les 12 CVE de Eclipse Theia →
CVE-2026-82217 In Eclipse Theia versions 1.73.0 up to but not including 1.75.0, the AI "Agent Mode" file-change tools… 8.8 Élevée CVE-2026-19884 In Eclipse Theia versions up to and including 1.69.0, opening a folder starts source control integration without… 8.4 Élevée CVE-2026-61891 In Eclipse Theia versions up to and including 1.73.1, the `@theia/filesystem` backend exposes HTTP file-download… 7.5 Élevée CVE-2026-60009 In Eclipse Theia versions up to and including 1.73.1, the `@theia/filesystem` backend binds `POST /file-upload` in every… 8.8 Élevée
Suivre cette CVE