CVE-2026-61891 Details
Description
In Eclipse Theia versions up to and including 1.73.1, the `@theia/filesystem` backend exposes HTTP file-download endpoints (`GET /file`, `GET /files/`, `PUT /files/`) that convert a client-supplied URI directly to a filesystem path and stream the file, without confining it to the workspace or any allow-listed root. In browser (non-Electron) deployments the connection token is enforced only on WebSocket upgrades; the HTTP middleware in `@theia/core` re-issues the cookie and calls `next()` without rejecting tokenless HTTP requests, so these endpoints are reachable without a valid token. As a result an unauthenticated client can read any file readable by the backend process, including files outside the opened workspace (for example `/etc/hosts`, SSH keys, or tokens). Electron mode uses a separate `ElectronSecurityToken` and is not affected via this path.
A vulnerability exists in Eclipse Theia versions through 1.73.1, where the '@theia/filesystem' backend allows arbitrary file reads via HTTP file-download endpoints. These endpoints convert client-supplied URIs directly to filesystem paths and stream the files, without restricting access to the workspace or any allow-listed roots. In non-Electron browser deployments, the connection token is only enforced on WebSocket upgrades, leaving these endpoints accessible without a valid token. This allows an unauthenticated client to read any file that the backend process can access, including sensitive files outside the opened workspace, such as '/etc/hosts', SSH keys, or tokens. Electron deployments are not affected as they use a separate 'ElectronSecurityToken'.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Aug 5, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/eclipse-theia/theia/security/advisories/GHSA-qqc8-9538-25v4 | [email protected] | Broken Link |
| https://gitlab.eclipse.org/security/cve-assignment/-/work_items/176 | [email protected] | Vendor Advisory |
| https://gitlab.eclipse.org/security/vulnerability-reports/-/issues/570 | [email protected] | Issue TrackingVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-200 | Exposure of Sensitive Information to an Unauthorized Actor | [email protected] |
| CWE-22 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') | [email protected] |
| CWE-306 | Missing Authentication for Critical Function | [email protected] |
| CWE-36 | Absolute Path Traversal | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| eclipse theia | < 1.74.0 |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Aug 7, 2026 | Initial Analysis | [email protected] |
| Aug 5, 2026 | CVE Modified | CISA-ADP |
| Aug 5, 2026 | New CVE Received | [email protected] |