What is the CVSS score of EUVD-2026-53303?

EUVD-2026-53303 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.4%.

Which versions of Eclipse Theia are affected by EUVD-2026-53303?

Eclipse Theia versions 1.66.0 through 1.73.1 contain an unauthenticated path traversal vulnerability allowing remote attackers to download arbitrary files, with no public exploit identified at time…. A patch is available.

How to fix or mitigate EUVD-2026-53303?

Within 24 hours, identify all Eclipse Theia instances running versions 1.66.0-1.73.1 and document their network exposure and operational criticality. Within 7 days, implement network-based interim controls: deploy WAF rules to block /hostedPlugin/* endpoint requests containing percent-encoded path traversal sequences, restrict firewall access to the plugin-hosting endpoint to allowlisted trusted sources only, or disable the plugin-hosting feature entirely if not operationally required. Within 30 days, monitor vendor advisories for patch availability and establish an upgrade timeline; conduct forensic analysis of server logs covering the discovery period for evidence of exploitation attempts; and complete permanent remediation through patching or architectural changes.

Eclipse Theia EUVD-2026-53303

| CVE-2026-12609 HIGH

Path Traversal (CWE-22)

2026-08-05 emo@eclipse.org

GHSA-34gw-v4cc-pv7c

Path Traversal Theia

7.5

CVSS 3.1 · Vendor: eclipse

Severity by source

Vendor (eclipse) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

vuln.today AI

7.5 HIGH

Network-exposed unauthenticated endpoint with trivial percent-encoding technique; impact is read-only file disclosure with no integrity or availability effect.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (eclipse).

CVSS VectorVendor: eclipse

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Patch available

Aug 05, 2026 - 12:01 EUVD

Analysis Generated

Aug 05, 2026 - 11:31 vuln.today

CVE Published

Aug 05, 2026 - 11:16 cve.org

HIGH 7.5

DescriptionCVE.org

In Eclipse Theia versions 1.66.0 and up until including 1.73.1, the @theia/plugin-ext backend exposes the /hostedPlugin/:pluginId/:path(*) HTTP endpoint, which resolves the requested file path with path.resolve(localPath, filePath) without verifying that the resolved path stays within the plugin's directory. An unauthenticated network attacker can send percent-encoded ../ sequences (%2e%2e%2f) that decode into the path parameter and escape the plugin directory, allowing arbitrary files readable by the Theia backend process to be retrieved. Plugin IDs are derived deterministically from a plugin's publisher and name, so built-in plugins serve as reliable anchors that require no prior knowledge of the target system.

AnalysisAI

Path traversal in Eclipse Theia's plugin-hosting HTTP endpoint (versions 1.66.0 through 1.73.1) enables unauthenticated remote attackers to exfiltrate arbitrary files readable by the Theia backend process by injecting percent-encoded directory traversal sequences. The /hostedPlugin/:pluginId/:path(*) endpoint passes user-supplied path data directly into path.resolve() without subsequently verifying the resolved path stays within the plugin directory boundary. Critically, because plugin IDs are deterministically derived from publisher and plugin name, an attacker can use well-known built-in plugins as traversal anchors without any prior reconnaissance of the target system. No public exploit code or CISA KEV listing has been identified at time of analysis.

Technical ContextAI

Eclipse Theia is an open-source cloud and desktop IDE framework built on Node.js. Its @theia/plugin-ext package exposes a static file-serving endpoint at /hostedPlugin/:pluginId/:path(*) designed to serve assets from locally hosted plugin directories. The root cause is a textbook CWE-22 (Improper Limitation of a Pathname to a Restricted Directory): the code calls path.resolve(localPath, filePath) to construct the absolute target path but never checks that the resolved result falls within localPath. When the HTTP server receives percent-encoded traversal sequences (%2e%2e%2f decoding to ../), URL decoding happens before path.resolve() sees the input, allowing the attacker to climb arbitrarily far up the filesystem. The deterministic plugin ID scheme - derived from a plugin's publisher and name fields - means widely-known built-in Theia plugins serve as reliable, pre-computed traversal anchors, removing any guessing component from the attack.

RemediationAI

Upgrade Eclipse Theia to a version beyond 1.73.1 once a patched release is confirmed - the exact fix version is not stated in the available intelligence and must be verified against the vendor advisory at https://github.com/eclipse-theia/theia/security/advisories/GHSA-qmm6-p8q4-2g48 before deploying. As a compensating control pending a patch, restrict network access to the Theia backend HTTP port using firewall rules or reverse-proxy ACLs so only explicitly trusted clients can reach the /hostedPlugin/ route; note this is ineffective if untrusted users already hold legitimate access to the Theia instance. A reverse proxy (nginx, HAProxy) can be configured to block requests whose path contains percent-encoded dot or slash sequences (%2e, %2f), but URL normalization handling must be rigorously validated to prevent bypass via double-encoding or Unicode variants. Additionally, run the Theia backend process under a least-privilege OS user account to minimise the set of files an attacker can retrieve even if traversal succeeds - this does not prevent exploitation but materially limits blast radius.