In Eclipse Theia versions 1.66.0 up to and including 1.73.1, the @theia/plugin-ext backend exposes an HTTP endpoint that resolves file paths without verifying that the resolved path remains within the plugin directory. This improper validation allows an unauthenticated network attacker to use percent-encoded '../' sequences to escape the intended directory and retrieve arbitrary files readable by the backend process. Plugin IDs are deterministically derived from plugin publisher and name, making built-in plugins reliable anchors for exploitation without needing prior knowledge of the target system.

An unauthenticated remote attacker can read arbitrary files on the system accessible to the Eclipse Theia backend process. This can lead to disclosure of sensitive information. The vulnerability does not allow modification or denial of service but compromises confidentiality.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict network access to the Theia backend and monitor for suspicious requests targeting the /hostedPlugin endpoint.