CVE-2026-60009 Details

A vulnerability exists in Eclipse Theia versions prior to 1.74.0, specifically within the '@theia/filesystem' backend. The issue arises because the backend binds 'POST /file-upload' in every filesystem-enabled deployment. The handler accepts an absolute path supplied by the attacker through the multipart 'uri' field and executes 'fs.move(tmp, target, { overwrite: true })' without any workspace confinement or authentication. In browser (non-Electron) deployments, the connection token is only enforced on WebSocket upgrades. The HTTP middleware in '@theia/core' reissues the cookie and proceeds without rejecting tokenless HTTP requests. This vulnerability allows a cross-origin web page to trigger the file write without preflight or credentials, leading to an unauthenticated arbitrary file write outside the workspace to any absolute path the backend process can access. This arbitrary file write can escalate to remote code execution by overwriting a file executed at startup, such as '~/.bashrc'.

To address this vulnerability, the connection token should be enforced on all HTTP routes, not just WebSocket upgrades. Additionally, the '/file-upload' route should be confined to the workspace root, rejecting absolute paths outside an allowed root. Until patched, users can avoid exposing a browser-mode Theia backend to untrusted networks or running it where untrusted web pages may be visited in the same session.