CVE-2026-61891 Overview
CVE-2026-61891 is a path traversal vulnerability in Eclipse Theia versions up to and including 1.73.1. The @theia/filesystem backend exposes HTTP file-download endpoints (GET /file, GET /files/, PUT /files/) that convert client-supplied URIs directly to filesystem paths without confining them to the workspace or an allow-listed root. In browser (non-Electron) deployments, the connection token is enforced only on WebSocket upgrades. The HTTP middleware in @theia/core re-issues the cookie and calls next() without rejecting tokenless HTTP requests. An unauthenticated attacker can read any file readable by the backend process, including SSH keys, tokens, and /etc/hosts. Electron mode uses a separate ElectronSecurityToken and is not affected via this path.
Critical Impact
Unauthenticated remote attackers can read arbitrary files accessible to the Theia backend process, exposing credentials, SSH keys, and sensitive configuration data outside the intended workspace boundary.
Affected Products
- Eclipse Theia versions up to and including 1.73.1 (browser deployments)
- @theia/filesystem backend package
- @theia/core HTTP middleware component
Discovery Timeline
- 2026-08-05 - CVE-2026-61891 published to NVD
- 2026-08-05 - Last updated in NVD database
Technical Details for CVE-2026-61891
Vulnerability Analysis
The vulnerability [CWE-22] resides in the @theia/filesystem backend, which registers three HTTP endpoints for file transfer: GET /file, GET /files/, and PUT /files/. These handlers accept a URI parameter supplied by the client and translate it directly into a filesystem path. The backend then streams the requested resource to the caller.
The handlers perform no workspace confinement. They do not verify that the resolved path resides within the currently opened workspace or any pre-configured allow-listed root. As a result, any absolute path readable by the Node.js backend process is retrievable through a crafted request.
Root Cause
Two independent design flaws combine to produce the exploitable condition. First, the file-transfer handlers omit canonicalization and boundary checks against the workspace root. Second, the @theia/core HTTP middleware enforces the browser connection token only during WebSocket upgrades. For plain HTTP requests, the middleware re-issues the token cookie and immediately invokes next() instead of rejecting tokenless calls. The authentication layer therefore never gates file-transfer endpoints in browser mode.
Attack Vector
An unauthenticated attacker sends an HTTP GET request to the exposed Theia backend, supplying a file:// URI that points outside the workspace. The middleware admits the request, the filesystem handler resolves the URI to an absolute path, and the backend streams the file contents in the response. Typical targets include /etc/passwd, /etc/hosts, ~/.ssh/id_rsa, cloud credential files, and application configuration containing API tokens. Attackers reach the endpoint over the network whenever the Theia server binds to a routable interface or is proxied through a reverse proxy without additional authentication.
See the Eclipse Theia GitHub Security Advisory for vendor-authored technical details.
Detection Methods for CVE-2026-61891
Indicators of Compromise
- HTTP requests to /file, /files/, or /files/ paths on Theia backend ports without a valid connection token cookie.
- Requests containing URI parameters that reference paths outside the configured workspace root, such as /etc/, /root/, or ~/.ssh/.
- Outbound file transfers from the Theia backend process to unexpected client IP addresses.
- New or unusual Set-Cookie responses re-issuing connection tokens for tokenless HTTP callers.
Detection Strategies
- Inspect reverse-proxy and application logs for GET /file and GET /files/ requests with absolute or traversal-style URI parameters.
- Alert on Theia backend responses that stream files whose paths do not begin with the workspace directory.
- Correlate access to sensitive files (SSH keys, cloud credentials) with the parent Node.js process running Theia.
Monitoring Recommendations
- Forward Theia backend and reverse-proxy access logs into a centralized analytics pipeline such as Singularity Data Lake for retrospective hunting.
- Track process-level file reads on hosts running Theia and flag reads of credential material by the Theia backend user.
- Baseline expected request paths and alert on deviations that indicate reconnaissance against the file-transfer endpoints.
How to Mitigate CVE-2026-61891
Immediate Actions Required
- Upgrade Eclipse Theia to a fixed release above 1.73.1 once published by the Eclipse Theia project.
- Restrict network exposure of the Theia backend to trusted networks or bind it to localhost only.
- Place Theia behind a reverse proxy that enforces its own authentication and denies unauthenticated access to /file and /files/ routes.
- Rotate any SSH keys, API tokens, or credentials that were readable by the Theia backend process on exposed instances.
Patch Information
Refer to the Eclipse Theia GitHub Security Advisory GHSA-qqc8-9538-25v4 and the Eclipse GitLab CVE assignment for authoritative fix availability and release notes. Track the Eclipse GitLab vulnerability report for remediation status.
Workarounds
- Deploy Theia in Electron mode where feasible, since the ElectronSecurityToken path is not affected.
- Add a reverse-proxy rule that rejects HTTP requests to /file, /files/, and /files/ unless they carry a valid session credential enforced upstream.
- Run the Theia backend under a dedicated low-privilege user account whose filesystem access is limited to the workspace directory using OS-level permissions or a mount namespace.
- Disable public network exposure of the Theia instance until upgrade is complete.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
