{"id":"CVE-2026-12609","published":"2026-08-05T11:16:24.080","lastModified":"2026-08-07T20:23:46.517","description":"In Eclipse Theia versions 1.66.0 and up until including 1.73.1, the `@theia/plugin-ext` backend exposes the `/hostedPlugin/:pluginId/:path(*)` HTTP endpoint, which resolves the requested file path with `path.resolve(localPath, filePath)` without verifying that the resolved path stays within the plugin's directory. An unauthenticated network attacker can send percent-encoded `../` sequences (`%2e%2e%2f`) that decode into the path parameter and escape the plugin directory, allowing arbitrary files readable by the Theia backend process to be retrieved. Plugin IDs are derived deterministically from a plugin's publisher and name, so built-in plugins serve as reliable anchors that require no prior knowledge of the target system.","cvssScore":7.5,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","cwes":["CWE-22"],"vendors":["eclipse"],"products":["theia"],"references":[{"url":"https://github.com/eclipse-theia/theia/security/advisories/GHSA-qmm6-p8q4-2g48","tags":["Broken Link"]},{"url":"https://gitlab.eclipse.org/security/cve-assignment/-/work_items/133","tags":["Vendor Advisory"]},{"url":"https://gitlab.eclipse.org/security/vulnerability-reports/-/issues/524","tags":["Issue Tracking","Mitigation","Vendor Advisory"]}],"exploitRefs":[{"url":"https://github.com/eclipse-theia/theia/security/advisories/GHSA-qmm6-p8q4-2g48","tags":["Broken Link"]}],"hasPoc":true,"ai":{"summary":"The flaw allows unauthenticated attackers to read arbitrary files by manipulating path parameters in the `/hostedPlugin` endpoint, due to improper path resolution.","exploitability":"Exploitation requires sending specially crafted requests with percent-encoded sequences; no prior knowledge of the target system is needed beyond plugin IDs.","blast_radius":"If exploited, this could lead to unauthorized data exposure across the network, impacting sensitive information within the Theia backend process.","remediation":"Downgrade to a version below 1.66.0 or apply official patches if available; otherwise, disable the `@theia/plugin-ext` backend until a fix is released.","tags":["rce","file-read","web","patch-recommended"],"model":"qwen2.5:7b-instruct","analyzedAt":"2026-08-11T06:59:07.627Z"}}