CVE-2026-61891 is a directory traversal vulnerability (CWE-22) in Eclipse Theia up to version 1.73.1. The @theia/filesystem backend exposes HTTP endpoints that map client-supplied URIs directly to filesystem paths and stream files without confinement to the workspace or allow-listed directories. In browser (non-Electron) deployments, the HTTP middleware does not enforce connection tokens on HTTP requests, allowing unauthenticated access to these endpoints. This enables an attacker to read arbitrary files readable by the backend process, including sensitive system and user files. Electron deployments use a separate security token mechanism and are not vulnerable through this vector.

An unauthenticated remote attacker can read arbitrary files on the server running Eclipse Theia, including files outside the intended workspace boundaries. This can lead to exposure of sensitive information such as system configuration files, SSH keys, and authentication tokens. The vulnerability does not allow modification or denial of service but results in a confidentiality breach. Electron mode deployments are not affected via this vulnerability path.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to Eclipse Theia HTTP endpoints to trusted users and networks. Consider deploying Eclipse Theia in Electron mode if feasible, as it is not affected by this vulnerability via the described path. Monitor vendor communications for updates and apply patches promptly once available.