In Eclipse Theia versions up to and including 1.73.1, the @theia/filesystem backend exposes HTTP endpoints (GET /file, GET /files/, PUT /files/) that map client-supplied URIs directly to filesystem paths and stream files without confinement to the workspace or allow-listed directories. The HTTP middleware in @theia/core re-issues cookies and calls next() without rejecting HTTP requests lacking a valid connection token, making these endpoints accessible without authentication in browser (non-Electron) deployments. This allows unauthenticated clients to read any file accessible by the backend process, including sensitive files outside the workspace such as /etc/hosts or SSH keys. Electron mode uses a separate ElectronSecurityToken and is not vulnerable via this path.

An unauthenticated attacker can read arbitrary files on the backend filesystem that the Theia process has access to, including sensitive system files and credentials outside the workspace. This can lead to information disclosure but does not allow modification or denial of service. The vulnerability affects browser deployments but not Electron mode.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, avoid exposing Theia browser deployments with the vulnerable @theia/filesystem backend to untrusted networks. Electron mode is not affected by this vulnerability via this path.