CVE-2026-61891

In Eclipse Theia versions up to and including 1.73.1, the `@theia/filesystem` backend exposes HTTP file-download endpoints (`GET /file`, `GET /files/`, `PUT /files/`) that convert a client-supplied URI directly to a filesystem path and stream the file, without confining it to the workspace or any allow-listed root. In browser (non-Electron) deployments the connection token is enforced only on WebSocket upgrades; the HTTP middleware in `@theia/core` re-issues the cookie and calls `next()` without rejecting tokenless HTTP requests, so these endpoints are reachable without a valid token. As a result an unauthenticated client can read any file readable by the backend process, including files outside the opened workspace (for example `/etc/hosts`, SSH keys, or tokens). Electron mode uses a separate `ElectronSecurityToken` and is not affected via this path.

• CWE-22
• CWE-36
• CWE-200
• CWE-306

• https://github.com/eclipse-theia/theia/security/advisories/GHSA-qqc8-9538-25v4Broken Link
• https://gitlab.eclipse.org/security/cve-assignment/-/work_items/176Vendor Advisory
• https://gitlab.eclipse.org/security/vulnerability-reports/-/issues/570Issue Tracking, Vendor Advisory

Published

Aug 5, 2026

Last Modified

Aug 7, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-61875luci-app-upnp contains a stored cross-site scripting vulnera…8.8
• CVE-2026-61876LuCI versions fail to properly encode DHCPv6 lease hostnames…9.4
• CVE-2026-6188A flaw has been found in SourceCodester Pharmacy Sales and I…7.3
• CVE-2026-61884The Tycon Systems TPDIN-Monitor-WEB2 ships without HTTP cred…9.8
• CVE-2026-61886Weintek cMT3092X HMI stores user account passwords in plaint…7.1
• CVE-2026-6189A vulnerability has been found in SourceCodester Pharmacy Sa…7.3
• CVE-2026-61892Weintek cMT3092X HMI allows a non-privileged user to modify …8.8
• CVE-2026-61893A crafted IEC 60870-5-104 I-frame with TypeID 104 (C_TS_NA_1…6.5
• CVE-2026-61897An Ubuntu-specific patch to AccountsService before 23.13.9-8…7.8
• CVE-2026-61898The Ubuntu-specific language helper scripts (save-to-pam-env…7.8
• CVE-2026-61899Vulnerability in tapestry-core in Apache Tapestry 5.5.0+ on …7.5
• CVE-2026-6190A vulnerability was found in itsourcecode Construction Manag…6.3