In Eclipse Theia versions up to and including 1.73.1, the `@theia/filesystem` backend exposes HTTP file-download endpoints (`GET /file`, `GET /files/`, `PUT /files/`) that convert a client-supplied URI directly to a filesystem path and stream the file, without confining it to the workspace or any allow-listed root. In browser (non-Electron) deployments the connection token is enforced only on WebSocket upgrades; the HTTP middleware in `@theia/core` re-issues the cookie and calls `next()` without rejecting tokenless HTTP requests, so these endpoints are reachable without a valid token. As a result an unauthenticated client can read any file readable by the backend process, including files outside the opened workspace (for example `/etc/hosts`, SSH keys, or tokens). Electron mode uses a separate `ElectronSecurityToken` and is not affected via this path.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:NEclipse Theia
APPEclipse< 1.74.0
Related vulnerabilities
RCE i XXE w Eclipse Theia via theia-xml-extension
Eclipse Theia: RCE przez podatność XSS w Markdown Preview
Eclipse Theia — path traversal w endpoincie hostedPlugin umożliwia odczyt plików
Eclipse Theia — nieuwierzytelniony arbitrary file write z możliwością RCE
In Eclipse Theia versions prior to 1.71.0, the AI chat agent processed workspace file and directory names as p...