What is the CVSS score of CVE-2026-61891?

CVE-2026-61891 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.5%.

Which versions of Eclipse Theia are affected by CVE-2026-61891?

Eclipse Theia browser-mode deployments (versions 1.73.1 and earlier) contain an unauthenticated arbitrary file read vulnerability enabling unauthorized exfiltration of SSH keys, cloud credentials,…. A patch is available.

How to fix or mitigate CVE-2026-61891?

Within 24 hours, inventory all Eclipse Theia deployments and identify instances running version 1.73.1 or earlier, prioritizing those exposed to untrusted networks. Within 7 days, upgrade all affected Theia instances to patched versions per vendor advisory; for instances that cannot be immediately patched, disable browser-mode deployment or implement network segmentation to restrict client access to trusted networks only. Within 30 days, confirm all Theia instances have been upgraded, review access logs for suspicious file read patterns, and assess whether any credentials stored in exfiltrable locations require rotation.

Eclipse Theia CVE-2026-61891

EUVD-2026-53327 HIGH

Path Traversal (CWE-22)

2026-08-05 eclipse

GHSA-xrrm-6636-87r2

Path Traversal Eclipse Theia

7.5

CVSS 3.1 · Vendor: eclipse

Severity by source

Vendor (eclipse) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

vuln.today AI

7.5 HIGH

Network-reachable with no auth or interaction in browser mode; pure read primitive produces high confidentiality impact with no integrity, availability, or scope-change consequence.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (eclipse).

CVSS VectorVendor: eclipse

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Aug 05, 2026 - 12:16 vuln.today

Patch available

Aug 05, 2026 - 12:01 EUVD

CVE Published

Aug 05, 2026 - 11:03 cve.org

HIGH 7.5

DescriptionCVE.org

In Eclipse Theia versions up to and including 1.73.1, the @theia/filesystem backend exposes HTTP file-download endpoints (GET /file, GET /files/, PUT /files/) that convert a client-supplied URI directly to a filesystem path and stream the file, without confining it to the workspace or any allow-listed root. In browser (non-Electron) deployments the connection token is enforced only on WebSocket upgrades; the HTTP middleware in @theia/core re-issues the cookie and calls next() without rejecting tokenless HTTP requests, so these endpoints are reachable without a valid token. As a result an unauthenticated client can read any file readable by the backend process, including files outside the opened workspace (for example /etc/hosts, SSH keys, or tokens). Electron mode uses a separate ElectronSecurityToken and is not affected via this path.

AnalysisAI

Unauthenticated arbitrary file read in Eclipse Theia browser-mode deployments (versions ≤1.73.1) allows any network client to exfiltrate files accessible to the backend process, including paths outside the opened workspace such as SSH keys, cloud credential tokens, and system configuration files. The vulnerability combines two compounding flaws: the @theia/filesystem HTTP endpoints perform no workspace confinement when resolving client-supplied URIs to filesystem paths, and a middleware defect in @theia/core re-issues the session cookie and calls next() without validating the connection token on HTTP requests - token enforcement applies only to WebSocket upgrades, leaving all HTTP file endpoints fully exposed. Electron deployments are explicitly not affected via this path. No public exploit is identified at time of analysis.

Technical ContextAI

Eclipse Theia is an open-source, extensible cloud and desktop IDE platform. The @theia/filesystem package exposes three HTTP REST endpoints - GET /file, GET /files/, and PUT /files/ - intended for workspace file access. The root cause (CWE-22, Path Traversal) is that these handlers convert a client-supplied URI directly to a filesystem path and stream the response without verifying the resolved path falls within the workspace root or any allow-listed directory. A second, independent flaw in @theia/core HTTP middleware means the connection token - which would normally gate access - is checked only during WebSocket upgrade handshakes. For plain HTTP requests the middleware re-issues the cookie and invokes next(), bypassing the token check entirely. Together these flaws produce a fully unauthenticated, unrestricted read primitive against the backend process's filesystem view. The affected CPE is cpe:2.3:a:eclipse_foundation:eclipse_theia:*:*:*:*:*:*:*:* covering all releases prior to 1.74.0. Electron mode ships a separate ElectronSecurityToken mechanism that is not subject to this HTTP middleware bypass.

RemediationAI

The primary fix is to upgrade Eclipse Theia to version 1.74.0 or later, which corrects both the missing workspace confinement in @theia/filesystem and the token-enforcement bypass in @theia/core HTTP middleware; the vendor advisory at https://github.com/eclipse-theia/theia/security/advisories/GHSA-qqc8-9538-25v4 should be reviewed for full patch details. If immediate upgrade is not feasible, place the Theia HTTP backend behind a reverse proxy (e.g., nginx with OAuth2 Proxy or HTTP basic auth) configured to enforce authentication on all HTTP routes - not merely WebSocket upgrades - which directly neutralises the token bypass; note that a misconfigured proxy that only covers WebSocket paths will not mitigate the flaw. Additionally, restrict network-level access to the Theia backend to trusted IP ranges or a VPN to limit the attack surface. As a defence-in-depth measure, reduce the filesystem permissions of the backend process user to the minimum required workspace directories, limiting the blast radius of any read primitive even if other controls are bypassed. Electron deployments require no remediation for this specific issue.