Directory Traversal Vulnerability in Eclipse Theia's Filesystem Management

CVE-2026-61891

What is CVE-2026-61891?

The vulnerability in Eclipse Theia affects versions up to and including 1.73.1, where the @theia/filesystem backend inadequately secures HTTP file-download endpoints. This flaw allows an unauthenticated client to exploit endpoints like GET /file, GET /files/, and PUT /files/ that translate client-supplied URIs directly into filesystem paths. Consequently, the lack of proper safeguards enables access to sensitive files outside the defined workspace, such as system config files and SSH keys. While Electron deployments use a more stringent security token, non-Electron configurations remain vulnerable, as token enforcement fails on basic HTTP requests, posing a significant risk of unauthorized file exposure.

References