CVE-2026-61891

Name of the Vulnerable Software and Affected Versions Eclipse Theia versions prior to 1.73.2

Description The @theia/filesystem backend exposes HTTP file-download endpoints GET /file, GET /files/, and PUT /files/ that convert a client-supplied URI directly to a filesystem path and stream the file without confining it to the workspace or an allow-listed root. In browser deployments, the connection token is only enforced during WebSocket upgrades, while the HTTP middleware in @theia/core fails to reject tokenless HTTP requests. This allows an unauthenticated client to read any file accessible by the backend process, including sensitive files outside the workspace such as /etc/hosts, SSH keys, or tokens.

Recommendations Update to version 1.73.2 or later.