Arbitrary File Write Vulnerability in Eclipse Theia Filesystem Component

CVE-2026-60009

What is CVE-2026-60009?

In Eclipse Theia versions up to and including 1.73.1, a vulnerability in the @theia/filesystem backend allows attackers to exploit the POST /file-upload handler. The vulnerability arises from the acceptance of an attacker-controlled absolute path from the multipart uri field without proper workspace confinement or authentication checks. This oversight permits unauthorized write operations to any filesystem location the backend process can access, making it possible for attackers to overwrite sensitive files, potentially leading to remote code execution. The vulnerability is particularly concerning in browser deployments where CORS policies allow malicious scripts to trigger file writes without authentication.

References