In Eclipse Theia versions 1.66.0 up to and including 1.73.1, the @theia/plugin-ext backend exposes an HTTP endpoint that resolves file paths using path.resolve without validating that the resolved path stays within the intended plugin directory. This lack of validation allows an unauthenticated attacker to use percent-encoded directory traversal sequences (%2e%2e%2f) to escape the plugin directory and read arbitrary files accessible to the backend process. Plugin IDs are deterministically derived from plugin publisher and name, making built-in plugins reliable targets without requiring prior knowledge of the target system. This vulnerability is classified as CWE-22 (Improper Limitation of a Pathname to a Restricted Directory) and has a CVSS 3.1 base score of 7.5 (high severity).

An unauthenticated remote attacker can exploit this vulnerability to read arbitrary files on the system where the Eclipse Theia backend is running, limited to files accessible by the backend process. This could lead to disclosure of sensitive information. There is no indication of integrity or availability impact. No known exploits in the wild have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict network access to the Eclipse Theia backend to trusted users only and monitor for suspicious requests targeting the /hostedPlugin/ endpoint. Avoid exposing the service to untrusted networks.