Threats Tagged 'cve-2026-61891'
View all threats tagged with 'cve-2026-61891'. Filter and sort to focus on specific types of threats.
Stop chasing alerts. Route them.
Start free, then upgrade once to turn Radar into an automated delivery engine for your security stack.
Custom feeds / Automations: email, Slack, webhooks, SIEM/MISP / API access (baseline limits)
API access activates after upgrading in Console -> Billing.
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.
Filter Threats
Narrow down the results by type, severity, or affected countries
Threats Tagged 'cve-2026-61891'
Click on any threat for detailed analysis and mitigation recommendations
0 Eclipse Theia versions up to and including 1.73.1 have a vulnerability in the @theia/filesystem backend where HTTP file-download endpoints allow unauthenticated clients to read arbitrary files on the backend filesystem. This occurs because client-supplied URIs are converted directly to filesystem paths without confinement, and HTTP middleware does not enforce token validation for non-WebSocket HTTP requests in browser deployments. Electron mode is not affected by this issue. Join the discussion | GCVE Database | 08/05/2026, 11:03:01 UTC Added: 08/05/2026, 15:31:19 UTC |
0 Eclipse Theia versions up to and including 1.73.1 contain a directory traversal vulnerability in the @theia/filesystem backend HTTP file-download endpoints. These endpoints convert client-supplied URIs directly to filesystem paths without restricting access to the workspace or allowed roots. In browser deployments, token enforcement is ineffective on HTTP requests, allowing unauthenticated clients to read any file accessible by the backend process, including sensitive files outside the workspace. Electron mode is not affected by this vulnerability via this path. Join the discussion | CVE Database V5 | 08/05/2026, 11:03:01 UTC Added: 08/05/2026, 11:57:50 UTC |
Showing 1 to 2 of 2 results