Threats Tagged 'ghsa-34gw-v4cc-pv7c'

Eclipse Theia versions 1.66.0 through 1.73.1 contain a directory traversal vulnerability in the @theia/plugin-ext backend. The HTTP endpoint /hostedPlugin/:pluginId/:path(*) improperly resolves file paths without verifying that the resolved path remains within the plugin directory. This allows unauthenticated network attackers to retrieve arbitrary files readable by the Theia backend process by sending encoded traversal sequences. Plugin IDs are deterministic, enabling attackers to target built-in plugins without prior system knowledge. The vulnerability has a high severity with a CVSS score of 7.5.