← Back to search

CVE-2026-12609

7.5 HIGHpublic exploit available

Published 2026-08-05 · Updated 2026-08-07

AI risk analysis

Summary
The flaw allows unauthenticated attackers to read arbitrary files by manipulating path parameters in the `/hostedPlugin` endpoint, due to improper path resolution.
Exploitability
Exploitation requires sending specially crafted requests with percent-encoded sequences; no prior knowledge of the target system is needed beyond plugin IDs.
Blast radius
If exploited, this could lead to unauthorized data exposure across the network, impacting sensitive information within the Theia backend process.
Prioritized remediation
Downgrade to a version below 1.66.0 or apply official patches if available; otherwise, disable the `@theia/plugin-ext` backend until a fix is released.
rcefile-readwebpatch-recommended

Analysis generated locally by qwen2.5:7b-instruct (no data left the box). AI-assisted — verify against primary sources before acting.

NVD description

In Eclipse Theia versions 1.66.0 and up until including 1.73.1, the `@theia/plugin-ext` backend exposes the `/hostedPlugin/:pluginId/:path(*)` HTTP endpoint, which resolves the requested file path with `path.resolve(localPath, filePath)` without verifying that the resolved path stays within the plugin's directory. An unauthenticated network attacker can send percent-encoded `../` sequences (`%2e%2e%2f`) that decode into the path parameter and escape the plugin directory, allowing arbitrary files readable by the Theia backend process to be retrieved. Plugin IDs are derived deterministically from a plugin's publisher and name, so built-in plugins serve as reliable anchors that require no prior knowledge of the target system.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weaknesses

CWE-22

Vendors

eclipse

Products

theia

Public exploit & PoC references

All references

Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.