CVE-2026-60009: Eclipse Theia RCE Vulnerability

CVE-2026-60009 Overview

CVE-2026-60009 is an unauthenticated arbitrary file write vulnerability in Eclipse Theia versions up to and including 1.73.1. The @theia/filesystem backend exposes a POST /file-upload endpoint in every filesystem-enabled deployment. The handler accepts an attacker-controlled absolute path from the multipart uri field and calls fs.move(tmp, target, { overwrite: true }) without workspace confinement or authentication. Browser deployments enforce the connection token only on WebSocket upgrades, leaving the HTTP path unauthenticated. Because multipart/form-data is a Cross-Origin Resource Sharing (CORS) safelisted content type, a malicious web page can trigger the write cross-origin with no preflight and no credentials. The classification aligns with [CWE-22] path traversal.

Critical Impact
A remote, unauthenticated attacker can write arbitrary files to any path writable by the Theia backend process, escalating to remote code execution by overwriting startup files such as ~/.bashrc.

Affected Products

Eclipse Theia browser (non-Electron) deployments up to and including version 1.73.1
Any Theia-based IDE distribution bundling @theia/filesystem and @theia/core
Electron mode is not affected via this path because it uses a separate ElectronSecurityToken

Discovery Timeline

2026-08-05 - CVE-2026-60009 published to the National Vulnerability Database (NVD)
2026-08-05 - Last updated in NVD database

Technical Details for CVE-2026-60009

Vulnerability Analysis

The flaw is a combination of missing authentication and missing path confinement in the Theia filesystem backend. The POST /file-upload route in @theia/filesystem accepts a multipart request in which the uri field specifies the target absolute path on the server. The handler passes that value directly into fs.move(tmp, target, { overwrite: true }), replacing any file the backend process has write access to. The vulnerability is reachable across origins because multipart/form-data is CORS-safelisted, so browsers do not send a preflight and do not require credentials. This allows a user who simply visits a hostile web page while Theia is running locally to have arbitrary files overwritten.

Root Cause

Two defects combine to produce the vulnerability. First, the file-upload handler performs no workspace confinement check on the attacker-supplied uri, permitting writes outside the intended workspace directory. Second, the HTTP middleware in @theia/core re-issues the connection token cookie and calls next() even when the request carries no valid token. The token is only validated during WebSocket upgrades, leaving HTTP endpoints effectively unauthenticated in browser deployments.

Attack Vector

An attacker hosts a web page that submits a cross-origin multipart/form-data POST to http://localhost:<theia-port>/file-upload. The multipart body sets uri to an absolute path such as /home/user/.bashrc and attaches attacker-controlled content. No authentication header, cookie, or preflight is required. When the victim next opens a shell, the overwritten startup file executes attacker code under the victim's account, yielding remote code execution.

No verified proof-of-concept code is published in the referenced advisories. Refer to the Eclipse Theia GitHub Security Advisory GHSA-62f6-wcvg-54h3 for the authoritative technical description.

Detection Methods for CVE-2026-60009

Indicators of Compromise

HTTP POST requests to /file-upload on Theia listener ports originating from unexpected Origin or Referer headers
Unexpected modifications to shell startup files such as ~/.bashrc, ~/.zshrc, ~/.profile, or ~/.config/autostart/* on hosts running Theia
Theia backend log entries showing fs.move operations targeting paths outside the configured workspace root
Outbound connections initiated by shells spawned from user login sessions following recent Theia usage

Detection Strategies

Monitor process telemetry for the Theia Node.js process writing to files outside its workspace directory tree
Alert on HTTP requests to /file-upload that lack a valid connection token or arrive with a cross-site Origin header
Inspect web proxy logs for multipart/form-data POSTs to localhost or loopback developer ports from third-party web origins

Monitoring Recommendations

Enable file integrity monitoring on user startup files and system-wide profile scripts on developer workstations
Capture command-line telemetry for shells spawned after IDE sessions to detect execution of injected startup content
Review network egress from developer endpoints for callbacks that follow immediately after IDE use

How to Mitigate CVE-2026-60009

Immediate Actions Required

Upgrade Eclipse Theia and any Theia-based IDE distributions to a fixed release above 1.73.1 as soon as the vendor publishes it
Restrict the Theia backend to bind only to 127.0.0.1 and block external access at the host firewall
Disable or remove the @theia/filesystem file-upload route in deployments that do not require it
Audit developer workstations for unauthorized changes to shell startup files

Patch Information

Review the Eclipse Theia GitHub Security Advisory GHSA-62f6-wcvg-54h3 and the Eclipse GitLab CVE assignment record for the fixed version and patch details. Additional context is available in the Eclipse vulnerability report issue 595.

Workarounds

Deploy Theia in Electron mode where available, since the ElectronSecurityToken path is not affected
Place Theia behind a reverse proxy that enforces authentication and blocks POST /file-upload from untrusted origins
Enforce a strict Origin allowlist on the Theia HTTP layer and reject requests without a valid connection token on all HTTP routes, not only WebSocket upgrades
Run the Theia backend as a low-privilege user in a container or sandbox with a read-only home directory to limit the blast radius of arbitrary writes

bash

# Example: bind Theia to loopback and block external access
theia start --hostname=127.0.0.1 --port=3000

# Example: iptables rule to drop non-local traffic to the Theia port
iptables -A INPUT -p tcp --dport 3000 ! -s 127.0.0.1 -j DROP