CVE-2026-12609 in Theia
Summary
by MITRE • 08/05/2026
In Eclipse Theia versions 1.66.0 and up until including 1.73.1, the `@theia/plugin-ext` backend exposes the `/hostedPlugin/:pluginId/:path(*)` HTTP endpoint, which resolves the requested file path with `path.resolve(localPath, filePath)` without verifying that the resolved path stays within the plugin's directory. An unauthenticated network attacker can send percent-encoded `../` sequences (`%2e%2e%2f`) that decode into the path parameter and escape the plugin directory, allowing arbitrary files readable by the Theia backend process to be retrieved. Plugin IDs are derived deterministically from a plugin's publisher and name, so built-in plugins serve as reliable anchors that require no prior knowledge of the target system.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 08/05/2026
The vulnerability in Eclipse Theia versions 1.66.0 through 1.73.1 represents a critical path traversal flaw within the backend plugin extension service. This issue resides in the `@theia/plugin-ext` component which exposes an HTTP endpoint at `/hostedPlugin/:pluginId/:path(*)` designed to serve plugin-related files. The flaw stems from inadequate input validation where the system accepts user-supplied file paths without proper sanitization or directory boundary enforcement. When processing requests, the application utilizes `path.resolve(localPath, filePath)` which, while a standard approach for path resolution, fails to verify that the resulting absolute path remains within the confines of the intended plugin directory structure.
The technical exploitation mechanism relies on percent-encoded directory traversal sequences that decode into `../` patterns, allowing attackers to escape the designated plugin directory boundaries. This vulnerability affects all plugins including built-in ones since plugin identifiers are deterministically generated from publisher and name components, eliminating the need for prior reconnaissance of specific plugin names. The attack surface is particularly concerning because it requires no authentication and can be executed by any network entity capable of sending HTTP requests to the vulnerable endpoint.
The operational impact of this vulnerability extends beyond simple information disclosure as it allows adversaries to access arbitrary files that are readable by the Theia backend process. This could potentially expose sensitive configuration data, credentials stored in plugin directories, or other system resources accessible through the backend user context. The deterministic nature of plugin ID generation means attackers can reliably target built-in plugins without prior knowledge, making this vulnerability particularly dangerous for environments where Theia is deployed with elevated privileges or where plugin directories contain sensitive artifacts.
Security professionals should note that this vulnerability aligns with CWE-22 Path Traversal and maps to ATT&CK technique T1083 File and Directory Discovery, representing a classic privilege escalation vector through path manipulation. Organizations should implement immediate mitigations including restricting access to the affected endpoint through firewall rules or reverse proxy configurations, implementing proper path validation before file resolution, and ensuring that all plugin directories are properly sandboxed with minimal required permissions. The vulnerability highlights the importance of input validation in web applications and demonstrates how seemingly innocuous path resolution functions can create dangerous security holes when not properly constrained within application boundaries.