CVE-2026-60009

Name of the Vulnerable Software and Affected Versions Eclipse Theia versions prior to 1.73.2

Description The @theia/filesystem backend binds the 'POST /file-upload' endpoint in every filesystem-enabled deployment. The handler processes an absolute path provided by an attacker via the multipart uri field and executes fs.move(tmp, target, { overwrite: true }) without authentication or workspace confinement. In browser-based deployments, the connection token is only enforced during WebSocket upgrades, while the HTTP middleware in @theia/core fails to reject tokenless HTTP requests. Since multipart/form-data is a CORS-safelisted request type, a cross-origin web page can trigger an unauthenticated arbitrary file write to any absolute path accessible to the backend process. This can lead to remote code execution, such as by overwriting the ~/.bashrc file.

Recommendations Update to a version newer than 1.73.1.