CyberRota Analysis
AI-GeneratedEclipse Theia versions 1.66.0 to 1.73.1 are vulnerable due to the `@theia/plugin-ext` backend exposing an insecure HTTP endpoint that allows unauthenticated attackers to exploit path traversal vulnerabilities. By sending percent-encoded sequences, attackers can access arbitrary files outside the intended plugin directory, potentially exposing sensitive information. Organizations using affected versions of Theia should prioritize patching this vulnerability to mitigate the risk of unauthorized data access.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
In Eclipse Theia versions 1.66.0 and up until including 1.73.1, the `@theia/plugin-ext` backend exposes the `/hostedPlugin/:pluginId/:path(*)` HTTP endpoint, which resolves the requested file path with `path.resolve(localPath, filePath)` without verifying that the resolved path stays within the plugin's directory. An unauthenticated network attacker can send percent-encoded `../` sequences (`%2e%2e%2f`) that decode into the path parameter and escape the plugin directory, allowing arbitrary files readable by the Theia backend process to be retrieved. Plugin IDs are derived deterministically from a plugin's publisher and name, so built-in plugins serve as reliable anchors that require no prior knowledge of the target system.
Related CVEs
Other vulnerabilities affecting the same vendor(s)