In Eclipse Theia up to version 1.73.1, the @theia/filesystem backend exposes a POST /file-upload endpoint that accepts an attacker-controlled absolute path in the multipart 'uri' field and moves files without workspace confinement or authentication. In browser (non-Electron) deployments, the HTTP middleware fails to reject tokenless HTTP requests, allowing cross-origin web pages to trigger arbitrary file writes without preflight or credentials due to the CORS-safelisted nature of multipart/form-data. This unauthenticated arbitrary file write can lead to remote code execution by overwriting files executed at startup, such as ~/.bashrc. Electron mode uses a separate security token and is not vulnerable via this vector.

An unauthenticated attacker can write arbitrary files to any absolute path writable by the backend process outside the workspace. This can lead to remote code execution by overwriting startup-executed files, compromising system integrity and confidentiality. The vulnerability affects browser-based deployments but not Electron mode. The CVSS score of 8.8 reflects high impact on confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, avoid exposing the vulnerable POST /file-upload endpoint in browser deployments or restrict access to trusted origins. Electron mode is not affected by this vulnerability via this path.