EUVD-2026-53326
GHSA-2mw2-h8hj-xpjg
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
No authentication required on HTTP path; UI:R reflects mandatory victim page visit; arbitrary overwrite enables full integrity and availability loss, with RCE yielding confidentiality.
Primary rating from Vendor (eclipse).
CVSS VectorVendor: eclipse
Lifecycle Timeline
3DescriptionCVE.org
In Eclipse Theia versions up to and including 1.73.1, the @theia/filesystem backend binds POST /file-upload in every filesystem-enabled deployment. The handler takes an attacker-supplied absolute path from the multipart uri field and calls fs.move(tmp, target, { overwrite: true }) with no workspace confinement and no authentication. In browser (non-Electron) deployments the connection token is enforced only on WebSocket upgrades; the HTTP middleware in @theia/core re-issues the cookie and calls next() without rejecting tokenless HTTP requests. Because multipart/form-data is a CORS-safelisted request type, a cross-origin web page can trigger the write with no preflight and no credentials, resulting in an unauthenticated arbitrary file write outside the workspace to any absolute path the backend process can write. This can escalate to remote code execution, for example by overwriting a startup-executed file such as ~/.bashrc. Electron mode uses a separate ElectronSecurityToken and is not affected via this path.
AnalysisAI
Unauthenticated arbitrary file write in Eclipse Theia 1.73.1 and earlier (browser-mode deployments) allows any cross-origin web page to overwrite files at any absolute path the backend process can access, with a realistic escalation to remote code execution. The POST /file-upload handler in @theia/filesystem accepts attacker-controlled absolute paths with no workspace boundary check, while a distinct HTTP middleware flaw in @theia/core lets the connection token check pass without rejection for tokenless HTTP requests. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the victim to visit an attacker-controlled web page while their browser has network connectivity to a running Eclipse Theia backend in browser-mode (non-Electron) deployment - for example, a Theia instance exposed on a company intranet or a cloud development environment accessible over HTTP/HTTPS. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 score of 8.8 (High) with vector AV:N/AC:L/PR:N/UI:R is well-calibrated for this vulnerability. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | The primary fix is to upgrade Eclipse Theia to a patched release beyond 1.73.1; however, an exact confirmed patch version is not available from the provided input data - operators must consult the GitHub advisory at https://github.com/eclipse-theia/theia/security/advisories/GHSA-62f6-wcvg-54h3 for the authoritative fix version and release. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Identify and inventory all Eclipse Theia browser-mode instances in your environment and document their network accessibility. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
In Eclipse Theia 0.3.9 to 1.8.1, the "mini-browser" extension allows a user to preview HTML files in an iframe inside th
In versions of the @theia/plugin-ext component of Eclipse Theia prior to 1.18.0, Webview contents can be hijacked via po
In Eclipse Theia versions up to and including 0.16.0, in the notification messages there is no HTML escaping, so Javascr
In Eclipse Theia versions up to and including 1.8.0, in the debug console there is no HTML escaping, so arbitrary Javasc
In Eclipse Theia 0.1.1 to 0.2.0, it is possible to exploit the default build to obtain remote code execution (and XXE) v
Path traversal in Eclipse Theia's plugin-hosting HTTP endpoint (versions 1.66.0 through 1.73.1) enables unauthenticated
Prototype pollution in Eclipse Theia's preference resolution system exposes developers to application-logic manipulation
Same weakness CWE-22 – Path Traversal
View allShare
External POC / Exploit Code
Leaving vuln.today