CVE-2026-61891

Summary

In Eclipse Theia versions up to and including 1.73.1, the @theia/filesystem backend exposes HTTP file-download endpoints (GET /file, GET /files/, PUT /files/) that convert a client-supplied URI directly to a filesystem path and stream the file, without confining it to the workspace or any allow-listed root. In browser (non-Electron) deployments the connection token is enforced only on WebSocket upgrades; the HTTP middleware in @theia/core re-issues the cookie and calls next() without rejecting tokenless HTTP requests, so these endpoints are reachable without a valid token. As a result an unauthenticated client can read any file readable by the backend process, including files outside the opened workspace (for example /etc/hosts, SSH keys, or tokens). Electron mode uses a separate ElectronSecurityToken and is not affected via this path.

Affected Software

VendorProductVersion RangeStatus
Eclipse FoundationEclipse Theia0 < 1.74.0affected

Weaknesses

  • CWE-22: CWE-22
  • CWE-36: CWE-36
  • CWE-200: CWE-200
  • CWE-306: CWE-306

ADP Enrichment

CISA ADP Vulnrichment

  • SSVC:
  • Exploitation: none
    • Automatable: yes
    • Technical Impact: partial

References