Shodan
Vulnerabilities
Vulnerable Software

Vulnerability Details CVE-2026-61891

In Eclipse Theia versions up to and including 1.73.1, the `@theia/filesystem` backend exposes HTTP file-download endpoints (`GET /file`, `GET /files/`, `PUT /files/`) that convert a client-supplied URI directly to a filesystem path and stream the file, without confining it to the workspace or any allow-listed root. In browser (non-Electron) deployments the connection token is enforced only on WebSocket upgrades; the HTTP middleware in `@theia/core` re-issues the cookie and calls `next()` without rejecting tokenless HTTP requests, so these endpoints are reachable without a valid token. As a result an unauthenticated client can read any file readable by the backend process, including files outside the opened workspace (for example `/etc/hosts`, SSH keys, or tokens). Electron mode uses a separate `ElectronSecurityToken` and is not affected via this path.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.005
EPSS Ranking 37.1%
CVSS Severity
CVSS v3 Score 7.5
Products affected by CVE-2026-61891
  • Eclipse » Theia » Version: N/A
    cpe:2.3:a:eclipse:theia:-
  • Eclipse » Theia » Version: 0.0.1
    cpe:2.3:a:eclipse:theia:0.0.1
  • Eclipse » Theia » Version: 0.1.0
    cpe:2.3:a:eclipse:theia:0.1.0
  • Eclipse » Theia » Version: 0.1.1
    cpe:2.3:a:eclipse:theia:0.1.1
  • Eclipse » Theia » Version: 0.10.0
    cpe:2.3:a:eclipse:theia:0.10.0
  • Eclipse » Theia » Version: 0.11.0
    cpe:2.3:a:eclipse:theia:0.11.0
  • Eclipse » Theia » Version: 0.12.0
    cpe:2.3:a:eclipse:theia:0.12.0
  • Eclipse » Theia » Version: 0.13.0
    cpe:2.3:a:eclipse:theia:0.13.0
  • Eclipse » Theia » Version: 0.14.0
    cpe:2.3:a:eclipse:theia:0.14.0
  • Eclipse » Theia » Version: 0.15.0
    cpe:2.3:a:eclipse:theia:0.15.0
  • Eclipse » Theia » Version: 0.16.0
    cpe:2.3:a:eclipse:theia:0.16.0
  • Eclipse » Theia » Version: 0.16.1
    cpe:2.3:a:eclipse:theia:0.16.1
  • Eclipse » Theia » Version: 0.2.0
    cpe:2.3:a:eclipse:theia:0.2.0
  • Eclipse » Theia » Version: 0.2.1
    cpe:2.3:a:eclipse:theia:0.2.1
  • Eclipse » Theia » Version: 0.2.2
    cpe:2.3:a:eclipse:theia:0.2.2
  • Eclipse » Theia » Version: 0.2.3
    cpe:2.3:a:eclipse:theia:0.2.3
  • Eclipse » Theia » Version: 0.2.4
    cpe:2.3:a:eclipse:theia:0.2.4
  • Eclipse » Theia » Version: 0.3.0
    cpe:2.3:a:eclipse:theia:0.3.0
  • Eclipse » Theia » Version: 0.3.1
    cpe:2.3:a:eclipse:theia:0.3.1
  • Eclipse » Theia » Version: 0.3.10
    cpe:2.3:a:eclipse:theia:0.3.10
  • Eclipse » Theia » Version: 0.3.11
    cpe:2.3:a:eclipse:theia:0.3.11
  • Eclipse » Theia » Version: 0.3.12
    cpe:2.3:a:eclipse:theia:0.3.12
  • Eclipse » Theia » Version: 0.3.13
    cpe:2.3:a:eclipse:theia:0.3.13
  • Eclipse » Theia » Version: 0.3.14
    cpe:2.3:a:eclipse:theia:0.3.14
  • Eclipse » Theia » Version: 0.3.15
    cpe:2.3:a:eclipse:theia:0.3.15
  • Eclipse » Theia » Version: 0.3.16
    cpe:2.3:a:eclipse:theia:0.3.16
  • Eclipse » Theia » Version: 0.3.17
    cpe:2.3:a:eclipse:theia:0.3.17
  • Eclipse » Theia » Version: 0.3.18
    cpe:2.3:a:eclipse:theia:0.3.18
  • Eclipse » Theia » Version: 0.3.19
    cpe:2.3:a:eclipse:theia:0.3.19
  • Eclipse » Theia » Version: 0.3.2
    cpe:2.3:a:eclipse:theia:0.3.2
  • Eclipse » Theia » Version: 0.3.3
    cpe:2.3:a:eclipse:theia:0.3.3
  • Eclipse » Theia » Version: 0.3.4
    cpe:2.3:a:eclipse:theia:0.3.4
  • Eclipse » Theia » Version: 0.3.6
    cpe:2.3:a:eclipse:theia:0.3.6
  • Eclipse » Theia » Version: 0.3.7
    cpe:2.3:a:eclipse:theia:0.3.7
  • Eclipse » Theia » Version: 0.3.8
    cpe:2.3:a:eclipse:theia:0.3.8
  • Eclipse » Theia » Version: 0.3.9
    cpe:2.3:a:eclipse:theia:0.3.9
  • Eclipse » Theia » Version: 0.4.0
    cpe:2.3:a:eclipse:theia:0.4.0
  • Eclipse » Theia » Version: 0.5.0
    cpe:2.3:a:eclipse:theia:0.5.0
  • Eclipse » Theia » Version: 0.6.0
    cpe:2.3:a:eclipse:theia:0.6.0
  • Eclipse » Theia » Version: 0.6.1
    cpe:2.3:a:eclipse:theia:0.6.1
  • Eclipse » Theia » Version: 0.7.0
    cpe:2.3:a:eclipse:theia:0.7.0
  • Eclipse » Theia » Version: 0.7.1
    cpe:2.3:a:eclipse:theia:0.7.1
  • Eclipse » Theia » Version: 0.7.2
    cpe:2.3:a:eclipse:theia:0.7.2
  • Eclipse » Theia » Version: 0.8.0
    cpe:2.3:a:eclipse:theia:0.8.0
  • Eclipse » Theia » Version: 0.9.0
    cpe:2.3:a:eclipse:theia:0.9.0
  • Eclipse » Theia » Version: 1.1.0
    cpe:2.3:a:eclipse:theia:1.1.0
  • Eclipse » Theia » Version: 1.10.0
    cpe:2.3:a:eclipse:theia:1.10.0
  • Eclipse » Theia » Version: 1.11.0
    cpe:2.3:a:eclipse:theia:1.11.0
  • Eclipse » Theia » Version: 1.12.0
    cpe:2.3:a:eclipse:theia:1.12.0
  • Eclipse » Theia » Version: 1.12.1
    cpe:2.3:a:eclipse:theia:1.12.1
  • Eclipse » Theia » Version: 1.14.0
    cpe:2.3:a:eclipse:theia:1.14.0
  • Eclipse » Theia » Version: 1.15.0
    cpe:2.3:a:eclipse:theia:1.15.0
  • Eclipse » Theia » Version: 1.16.0
    cpe:2.3:a:eclipse:theia:1.16.0
  • Eclipse » Theia » Version: 1.17.0
    cpe:2.3:a:eclipse:theia:1.17.0
  • Eclipse » Theia » Version: 1.17.1
    cpe:2.3:a:eclipse:theia:1.17.1
  • Eclipse » Theia » Version: 1.17.2
    cpe:2.3:a:eclipse:theia:1.17.2
  • Eclipse » Theia » Version: 1.18.0
    cpe:2.3:a:eclipse:theia:1.18.0
  • Eclipse » Theia » Version: 1.19.0
    cpe:2.3:a:eclipse:theia:1.19.0
  • Eclipse » Theia » Version: 1.2.0
    cpe:2.3:a:eclipse:theia:1.2.0
  • Eclipse » Theia » Version: 1.3.0
    cpe:2.3:a:eclipse:theia:1.3.0
  • Eclipse » Theia » Version: 1.4.0
    cpe:2.3:a:eclipse:theia:1.4.0
  • Eclipse » Theia » Version: 1.5.0
    cpe:2.3:a:eclipse:theia:1.5.0
  • Eclipse » Theia » Version: 1.6.0
    cpe:2.3:a:eclipse:theia:1.6.0
  • Eclipse » Theia » Version: 1.7.0
    cpe:2.3:a:eclipse:theia:1.7.0
  • Eclipse » Theia » Version: 1.8.0
    cpe:2.3:a:eclipse:theia:1.8.0
  • Eclipse » Theia » Version: 1.8.1
    cpe:2.3:a:eclipse:theia:1.8.1
  • Eclipse » Theia » Version: 1.9.0
    cpe:2.3:a:eclipse:theia:1.9.0


Products
Pricing
Contact Us

Shodan ® - All rights reserved