CVE-2026-12609
Received Received - Intake

Path Traversal in Eclipse Theia Plugin Extension

Publication date: 2026-08-05

Last updated on: 2026-08-05

Assigner: Eclipse Foundation

Description
In Eclipse Theia versions 1.66.0 and up until including 1.73.1, the `@theia/plugin-ext` backend exposes the `/hostedPlugin/:pluginId/:path(*)` HTTP endpoint, which resolves the requested file path with `path.resolve(localPath, filePath)` without verifying that the resolved path stays within the plugin's directory. An unauthenticated network attacker can send percent-encoded `../` sequences (`%2e%2e%2f`) that decode into the path parameter and escape the plugin directory, allowing arbitrary files readable by the Theia backend process to be retrieved. Plugin IDs are derived deterministically from a plugin's publisher and name, so built-in plugins serve as reliable anchors that require no prior knowledge of the target system.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-05
Last Modified
2026-08-05
Generated
2026-08-05
AI Q&A
2026-08-05
EPSS Evaluated
N/A
NVD
CVE-2026-12609
EUVD
EUVD-2026-53303

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
eclipse theia From 1.66.0 (inc) to 1.73.1 (inc)
eclipse theia 1.72.300

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-22 The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a path traversal issue in Eclipse Theia versions 1.66.0 to 1.73.1. The `/hostedPlugin/:pluginId/:path(*)` endpoint resolves file paths without validating that the resolved path stays within the plugin directory. Attackers can send percent-encoded `../` sequences to escape the plugin directory and read arbitrary files accessible to the Theia backend process.

Detection Guidance

To detect this vulnerability, check if your Eclipse Theia instance is running versions 1.66.0 through 1.73.1. Inspect network traffic for requests to the /hostedPlugin/:pluginId/:path(*) endpoint with percent-encoded ../ sequences in the path parameter. Use curl commands like: curl -v 'http://<target>/hostedPlugin/vscode_bat/%2e%2e%2f%2e%2e%2f%2e%2e%2fetc%2fpasswd' to test for path traversal.

Verify file access by attempting to read sensitive files such as /etc/passwd or /etc/shadow. Check server logs for unusual requests to the /hostedPlugin endpoint.

Impact Analysis

An unauthenticated attacker could exploit this to read sensitive files on the server, such as configuration files, credentials, or system files like /etc/passwd. This could lead to data breaches, unauthorized access, or further attacks on the system hosting Theia.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating GDPR's data protection principles or HIPAA's requirements for safeguarding protected health information. Organizations using affected Theia versions may face compliance violations, legal penalties, and reputational damage.

Mitigation Strategies

Immediately upgrade Eclipse Theia to a version beyond 1.73.1 where the vulnerability is patched. If upgrading is not possible, restrict access to the /hostedPlugin endpoint via network firewall rules or reverse proxy configurations.

Apply input validation to sanitize path parameters in the /hostedPlugin endpoint. Ensure the resolved file path remains within the intended plugin directory by implementing containment checks after path resolution.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-12609. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart