CVE-2026-12609: Eclipse Theia - Unauthenticated Path Traversal
Eclipse Foundation · Eclipse Theia
Vendor fix available · Affected: Eclipse Foundation Eclipse Theia · Exploitation: check available, not yet exploited
Not in CyberSIXT coverage yet: no article names this CVE. This page shows the public record.
Higher than 76% of scored CVEs
DescriptionCVE.org
In Eclipse Theia versions 1.66.0 and up until including 1.73.1, the `@theia/plugin-ext` backend exposes the `/hostedPlugin/:pluginId/:path(*)` HTTP endpoint, which resolves the requested file path with `path.resolve(localPath, filePath)` without verifying that the resolved path stays within the plugin's directory. An unauthenticated network attacker can send percent-encoded `../` sequences (`%2e%2e%2f`) that decode into the path parameter and escape the plugin directory, allowing arbitrary files readable by the Theia backend process to be retrieved. Plugin IDs are derived deterministically from a plugin's publisher and name, so built-in plugins serve as reliable anchors that require no prior knowledge of the target system.
Affected products1
From the CVE record. A product or version that is not listed is unknown, not unaffected.
- Eclipse Foundation · Eclipse Theiafrom 1.66.0 before 1.74.0
On the Atlas
Every published CVE is on the CyberSIXT Atlas, grouped by weakness, vendor and month.
- Exploitation
- Check available, not yet exploited. A public nuclei template can confirm it on a system you are authorised to test.
- CISA KEV
- Not listed
- Public check
- Eclipse Theia - Unauthenticated Path Traversal · nuclei template in projectdiscovery/nuclei-templates
- Vendor
- Eclipse Foundation
- Published
- August 2026
CoverageNo articles yet
No CyberSIXT article names CVE-2026-12609 yet, so there is no coverage timeline, action brief or change log for it. Everything on this page comes from the public CVE record, CISA KEV, EPSS and the nuclei template index. Search the archive or see the CVEs in the news.