Eclipse Theia CVE-2026-12609

The Theia backend HTTP server must be network-reachable - this is the default configuration in all affected deployments. No authentication is required (PR:N per provided CVSS vector). The attacker must supply a valid plugin ID, but because IDs are deterministically derived from publisher and plugin name and Theia ships with well-known built-in plugins, no prior reconnaissance of the specific target system is necessary. The Theia backend process must have read permissions on the targeted files; in cloud IDE environments this permission set is typically broad. No non-default configuration flag, special platform, or specific Theia feature toggle is required - the vulnerable endpoint is present and active in all affected versions by default. Exploitation is bounded to files readable by the OS-level user account running the Theia backend process.

The CVSS 7.5 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) accurately represents the exploitation characteristics: the attack is trivially executed over the network with no authentication, no credentials, and no user interaction. The deterministic plugin ID structure makes the effective attack complexity lower than AC:L already implies - no target-specific enumeration is required. Impact is scoped to confidentiality: the attacker can retrieve any file the Theia backend process can read, which in cloud IDE environments (Gitpod, Eclipse Che) commonly includes SSH keys, OAuth tokens, .env files containing API secrets, application configuration, and source code. No EPSS score was included in the provided intelligence, and the vulnerability is absent from CISA KEV, indicating no confirmed widespread active exploitation at time of analysis. No POC code has been identified. Despite the absence of KEV listing, the trivial exploit mechanics and broad potential file exposure make this a genuine priority for any organization running a network-accessible Theia deployment.

An unauthenticated attacker sends an HTTP GET request such as GET /hostedPlugin/eclipse.vscode-builtin-css/%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2fhome/theia/.ssh/id_rsa HTTP/1.1 to the Theia backend. The server URL-decodes the path parameter to ../../../../home/theia/.ssh/id_rsa, and path.resolve() produces an absolute path outside the plugin directory; the Theia backend reads and returns the private key in the response body. No public POC has been identified, but the technique requires only a standard HTTP client and knowledge of any built-in plugin's deterministic ID.