Christian Damus

**Name of the Vulnerable Software and Affected Versions** Eclipse Theia versions prior to 1.73.2 **Description** The `@theia/filesystem` backend exposes HTTP file-download endpoints `GET /file`, `GET /files/`, and `PUT /files/` that convert a client-supplied URI directly to a filesystem path and stream the file without confining it to the workspace or an allow-listed root. In browser deployments, the connection token is only enforced during WebSocket upgrades, while the HTTP middleware in `@theia/core` fails to reject tokenless HTTP requests. This allows an unauthenticated client to read any file accessible by the backend process, including sensitive files outside the workspace such as `/etc/hosts`, SSH keys, or tokens. **Recommendations** Update to version 1.73.2 or later.