/Vulnerability Library

Eclipse Theia - Unauthenticated Path Traversal

CVE-2026-12609
Verified

Description

Eclipse Theia's plugin-ext backend exposes the hostedPlugin endpoint without constraining the resolved path to the plugin directory. An unauthenticated request using encoded traversal sequences can therefore read files accessible to the backend process. The built-in vscode_bat plugin identifier provides a deterministic anchor without target-specific setup.

Severity

High

CVSS Score

7.5

Exploit Probability

2%

Affected Product

theia

Published Date

September 10, 2026

Template Author

str4k3r

CVE-2026-12609.yaml
7.5Score

CVSS Metrics

CVSS Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVE ID:
cve-2026-12609
CWE ID:
cwe-22

References

https://github.com/eclipse-theia/theia/security/advisories/GHSA-qmm6-p8q4-2g48https://gitlab.eclipse.org/security/cve-assignment/-/work_items/133

Remediation Steps

Upgrade Eclipse Theia to the patched version.