EUVD-2026-53326
GHSA-2mw2-h8hj-xpjg
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
No authentication required on HTTP path; UI:R reflects mandatory victim page visit; arbitrary overwrite enables full integrity and availability loss, with RCE yielding confidentiality.
Primary rating from Vendor (eclipse).
CVSS VectorVendor: eclipse
Lifecycle Timeline
3DescriptionCVE.org
In Eclipse Theia versions up to and including 1.73.1, the @theia/filesystem backend binds POST /file-upload in every filesystem-enabled deployment. The handler takes an attacker-supplied absolute path from the multipart uri field and calls fs.move(tmp, target, { overwrite: true }) with no workspace confinement and no authentication. In browser (non-Electron) deployments the connection token is enforced only on WebSocket upgrades; the HTTP middleware in @theia/core re-issues the cookie and calls next() without rejecting tokenless HTTP requests. Because multipart/form-data is a CORS-safelisted request type, a cross-origin web page can trigger the write with no preflight and no credentials, resulting in an unauthenticated arbitrary file write outside the workspace to any absolute path the backend process can write. This can escalate to remote code execution, for example by overwriting a startup-executed file such as ~/.bashrc. Electron mode uses a separate ElectronSecurityToken and is not affected via this path.
AnalysisAI
Unauthenticated arbitrary file write in Eclipse Theia 1.73.1 and earlier (browser-mode deployments) allows any cross-origin web page to overwrite files at any absolute path the backend process can access, with a realistic escalation to remote code execution. The POST /file-upload handler in @theia/filesystem accepts attacker-controlled absolute paths with no workspace boundary check, while a distinct HTTP middleware flaw in @theia/core lets the connection token check pass without rejection for tokenless HTTP requests. Because multipart/form-data is a CORS-safelisted request type, browsers send the exploit request cross-origin with no preflight and no credentials. No public exploit has been identified at time of analysis, and no CISA KEV listing appears in the provided data, but the attack mechanism is straightforward and requires only that a victim visit an attacker-controlled page.
Technical ContextAI
Eclipse Theia is an open-source, extensible cloud and desktop IDE framework widely used as a foundation for browser-based development environments. The vulnerable component is the @theia/filesystem backend route POST /file-upload, which accepts a multipart form body containing a uri field representing the upload destination. The handler calls fs.move(tmp, target, { overwrite: true }) directly on the attacker-supplied path with no canonicalization, no workspace root check, and no path component sanitization - a textbook CWE-22 (Path Traversal / Improper Limitation of a Pathname to a Restricted Directory). A compounding design flaw in @theia/core's HTTP middleware re-issues the session cookie and calls next() without rejecting HTTP requests that lack a valid connection token; token enforcement is applied only on WebSocket upgrade paths, leaving all plain HTTP routes unauthenticated in browser deployments. The CORS bypass vector arises because multipart/form-data is a CORS-safelisted content type per the Fetch specification - browsers send it cross-origin without an OPTIONS preflight and without forwarding cookies, meaning neither CORS policy nor same-origin enforcement provides a backstop. Electron deployments use a distinct ElectronSecurityToken mechanism applied at a different layer and are not affected through this code path.
RemediationAI
The primary fix is to upgrade Eclipse Theia to a patched release beyond 1.73.1; however, an exact confirmed patch version is not available from the provided input data - operators must consult the GitHub advisory at https://github.com/eclipse-theia/theia/security/advisories/GHSA-62f6-wcvg-54h3 for the authoritative fix version and release. Until a patch is applied, the most effective compensating control is to restrict network access to the Theia backend so it is unreachable from untrusted browser contexts - bind the backend to localhost or an internal VLAN, or require a VPN for access; this eliminates the cross-origin attack vector entirely but prevents remote browser-based access to Theia. Placing an authenticating reverse proxy (such as OAuth2 Proxy, Nginx with auth_request, or a zero-trust gateway) in front of all Theia HTTP endpoints will block unauthenticated POST requests, though this requires careful configuration to avoid reintroducing the same HTTP middleware bypass. Blocking or disabling the /file-upload route at the reverse proxy layer is a more surgical workaround but may impair file management functionality. Restricting the operating-system user running the Theia backend to a confined home directory or using a read-only filesystem for sensitive paths (e.g., ~/.bashrc, crontabs, SSH authorized_keys) can limit the blast radius of a successful write. Electron-mode deployments require no immediate action.
In Eclipse Theia 0.3.9 to 1.8.1, the "mini-browser" extension allows a user to preview HTML files in an iframe inside th
In versions of the @theia/plugin-ext component of Eclipse Theia prior to 1.18.0, Webview contents can be hijacked via po
In Eclipse Theia versions up to and including 0.16.0, in the notification messages there is no HTML escaping, so Javascr
In Eclipse Theia versions up to and including 1.8.0, in the debug console there is no HTML escaping, so arbitrary Javasc
In Eclipse Theia 0.1.1 to 0.2.0, it is possible to exploit the default build to obtain remote code execution (and XXE) v
Path traversal in Eclipse Theia's plugin-hosting HTTP endpoint (versions 1.66.0 through 1.73.1) enables unauthenticated
Prototype pollution in Eclipse Theia's preference resolution system exposes developers to application-logic manipulation
Same weakness CWE-22 – Path Traversal
View allShare
External POC / Exploit Code
Leaving vuln.today