EUVD-2026-53303
GHSA-34gw-v4cc-pv7c
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Network-exposed unauthenticated endpoint with trivial percent-encoding technique; impact is read-only file disclosure with no integrity or availability effect.
Primary rating from Vendor (eclipse).
CVSS VectorVendor: eclipse
Lifecycle Timeline
3DescriptionCVE.org
In Eclipse Theia versions 1.66.0 and up until including 1.73.1, the @theia/plugin-ext backend exposes the /hostedPlugin/:pluginId/:path(*) HTTP endpoint, which resolves the requested file path with path.resolve(localPath, filePath) without verifying that the resolved path stays within the plugin's directory. An unauthenticated network attacker can send percent-encoded ../ sequences (%2e%2e%2f) that decode into the path parameter and escape the plugin directory, allowing arbitrary files readable by the Theia backend process to be retrieved. Plugin IDs are derived deterministically from a plugin's publisher and name, so built-in plugins serve as reliable anchors that require no prior knowledge of the target system.
AnalysisAI
Path traversal in Eclipse Theia's plugin-hosting HTTP endpoint (versions 1.66.0 through 1.73.1) enables unauthenticated remote attackers to exfiltrate arbitrary files readable by the Theia backend process by injecting percent-encoded directory traversal sequences. The /hostedPlugin/:pluginId/:path(*) endpoint passes user-supplied path data directly into path.resolve() without subsequently verifying the resolved path stays within the plugin directory boundary. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The Theia backend HTTP server must be network-reachable - this is the default configuration in all affected deployments. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 7.5 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) accurately represents the exploitation characteristics: the attack is trivially executed over the network with no authentication, no credentials, and no user interaction. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade Eclipse Theia to a version beyond 1.73.1 once a patched release is confirmed - the exact fix version is not stated in the available intelligence and must be verified against the vendor advisory at https://github.com/eclipse-theia/theia/security/advisories/GHSA-qmm6-p8q4-2g48 before deploying. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all Eclipse Theia instances running versions 1.66.0-1.73.1 and document their network exposure and operational criticality. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
In Eclipse Theia 0.3.9 to 1.8.1, the "mini-browser" extension allows a user to preview HTML files in an iframe inside th
In versions of the @theia/plugin-ext component of Eclipse Theia prior to 1.18.0, Webview contents can be hijacked via po
In Eclipse Theia versions up to and including 0.16.0, in the notification messages there is no HTML escaping, so Javascr
In Eclipse Theia versions up to and including 1.8.0, in the debug console there is no HTML escaping, so arbitrary Javasc
In Eclipse Theia 0.1.1 to 0.2.0, it is possible to exploit the default build to obtain remote code execution (and XXE) v
Unauthenticated arbitrary file write in Eclipse Theia 1.73.1 and earlier (browser-mode deployments) allows any cross-ori
Prototype pollution in Eclipse Theia's preference resolution system exposes developers to application-logic manipulation
Same weakness CWE-22 – Path Traversal
View allSame technique Path Traversal
View allShare
External POC / Exploit Code
Leaving vuln.today