Eclipse Theia versions up to and including 1.73.1 have a vulnerability in the @theia/filesystem backend where the POST /file-upload endpoint accepts an absolute path from the multipart 'uri' field and moves files without workspace confinement or authentication. In browser deployments, the HTTP middleware does not reject tokenless requests, allowing cross-origin web pages to perform unauthenticated arbitrary file writes. This can be exploited to overwrite files outside the workspace, potentially leading to remote code execution, for example by modifying startup scripts like ~/.bashrc. Electron mode uses a different security token and is not vulnerable via this attack vector.

An attacker can perform unauthenticated arbitrary file writes outside the workspace on affected Eclipse Theia browser deployments. This can lead to remote code execution by overwriting files executed on startup. The vulnerability has a CVSS 3.1 score of 8.8 (high severity) with network attack vector, low attack complexity, no privileges required, user interaction required, and high impact on confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, avoid using browser (non-Electron) deployments of Eclipse Theia in untrusted environments or restrict access to trusted origins only. Electron mode is not affected by this vulnerability via this path.