{"attribution":"This product uses data from the NVD API but is not endorsed or certified by the NVD.","cve":{"id":"CVE-2026-61891","sourceIdentifier":"emo@eclipse.org","published":"2026-08-05T12:18:57.310","lastModified":"2026-10-24T16:10:00.153","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"In Eclipse Theia versions up to and including 1.73.1, the `@theia/filesystem` backend exposes HTTP file-download endpoints (`GET /file`, `GET /files/`, `PUT /files/`) that convert a client-supplied URI directly to a filesystem path and stream the file, without confining it to the workspace or any allow-listed root. In browser (non-Electron) deployments the connection token is enforced only on WebSocket upgrades; the HTTP middleware in `@theia/core` re-issues the cookie and calls `next()` without rejecting tokenless HTTP requests, so these endpoints are reachable without a valid token. As a result an unauthenticated client can read any file readable by the backend process, including files outside the opened workspace (for example `/etc/hosts`, SSH keys, or tokens). Electron mode uses a separate `ElectronSecurityToken` and is not affected via this path."},{"lang":"es","value":"En las versiones de Eclipse Theia hasta la 1.73.1 inclusive, el backend “@theia/filesystem” expone puntos finales de descarga de archivos HTTP (’GET /file’, ’GET /files/’, ’PUT /files/’) que convierten una URI proporcionada por el cliente directamente en una ruta del sistema de archivos y transmiten el archivo, sin confinarlo al espacio de trabajo ni a ninguna raíz permitida. En despliegues de navegador (no Electron), el token de conexión se aplica solo en las actualizaciones de WebSocket; el middleware HTTP en “@theia/core” reemite la cookie y llama a “next()” sin rechazar las solicitudes HTTP sin token, por lo que estos puntos finales son accesibles sin un token válido. Como resultado, un cliente no autenticado puede leer cualquier archivo legible por el proceso de backend, incluyendo archivos fuera del espacio de trabajo abierto (por ejemplo, ’/etc/h0sts’, claves SSH o tokens). El modo Electron utiliza un “ElectronSecurityToken” separado y no se ve afectado por esta ruta."}],"affected":[{"source":"emo@eclipse.org","affectedData":[{"vendor":"Eclipse Foundation","product":"Eclipse Theia","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"1.74.0","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"emo@eclipse.org","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-08-05T12:34:58.985421Z","id":"CVE-2026-61891","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"emo@eclipse.org","type":"Secondary","description":[{"lang":"en","value":"CWE-22"},{"lang":"en","value":"CWE-36"},{"lang":"en","value":"CWE-200"},{"lang":"en","value":"CWE-306"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:eclipse:theia:*:*:*:*:*:*:*:*","versionEndExcluding":"1.74.0","matchCriteriaId":"670EAAD9-2B91-4846-B5B2-09E075AACF1F"}]}]}],"references":[{"url":"https://github.com/eclipse-theia/theia/security/advisories/GHSA-qqc8-9538-25v4","source":"emo@eclipse.org","tags":["Broken Link"]},{"url":"https://gitlab.eclipse.org/security/cve-assignment/-/work_items/176","source":"emo@eclipse.org","tags":["Vendor Advisory"]},{"url":"https://gitlab.eclipse.org/security/vulnerability-reports/-/issues/570","source":"emo@eclipse.org","tags":["Issue Tracking","Vendor Advisory"]}]}}