In Eclipse Theia versions up to and including 1.73.1, the @theia/filesystem backend exposes HTTP endpoints that convert client-supplied URIs directly to filesystem paths and stream files without restricting access to the workspace or allow-listed roots. In browser deployments, the HTTP middleware fails to reject tokenless HTTP requests, allowing unauthenticated clients to access any file readable by the backend process, including sensitive files outside the workspace. Electron mode uses a separate security token and is not vulnerable via this path.

An unauthenticated attacker can read arbitrary files accessible by the backend process, potentially exposing sensitive information such as system configuration files, SSH keys, or tokens. This leads to a confidentiality breach with no impact on integrity or availability reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, avoid exposing the vulnerable HTTP file-download endpoints in browser deployments or restrict access through network controls. Electron mode is not affected by this vulnerability via this path.