CVE-2026-12609

Name of the Vulnerable Software and Affected Versions Eclipse Theia versions 1.66.0 through 1.73.1

Description The @theia/plugin-ext backend exposes the /hostedPlugin/:pluginId/:path(*) HTTP endpoint. The system resolves the requested file path using the path.resolve(localPath, filePath) function without verifying if the resulting path remains within the intended plugin directory. An unauthenticated network attacker can use percent-encoded ../ sequences in the path parameter to escape the directory and retrieve arbitrary files readable by the Theia backend process. Because plugin IDs are derived deterministically from the publisher and name, built-in plugins can be used as reliable anchors for this attack.

Recommendations Update Eclipse Theia to a version later than 1.73.1. Restrict access to the /hostedPlugin/:pluginId/:path(*) endpoint to minimize the risk of unauthorized file retrieval.