CVE-2026-12609

{
  "id": "CVE-2026-12609",
  "sourceIdentifier": "[email protected]",
  "published": "2026-08-05T11:16:24.080",
  "lastModified": "2026-10-23T21:10:00.157",
  "vulnStatus": "Analyzed",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "In Eclipse Theia versions 1.66.0 and up until including 1.73.1, the `@theia/plugin-ext` backend exposes the `/hostedPlugin/:pluginId/:path(*)` HTTP endpoint, which resolves the requested file path with `path.resolve(localPath, filePath)` without verifying that the resolved path stays within the plugin's directory. An unauthenticated network attacker can send percent-encoded `../` sequences (`%2e%2e%2f`) that decode into the path parameter and escape the plugin directory, allowing arbitrary files readable by the Theia backend process to be retrieved. Plugin IDs are derived deterministically from a plugin's publisher and name, so built-in plugins serve as reliable anchors that require no prior knowledge of the target system."
    },
    {
      "lang": "es",
      "value": "En las versiones de Eclipse Theia 1.66.0 y hasta la 1.73.1 inclusive, el backend “@theia/plugin-ext” expone el endpoint HTTP “/hostedPlugin/:pluginId/:path(*)”, que resuelve la ruta de archivo solicitada con “path.resolve(localPath, filePath)” sin verificar que la ruta resuelta permanezca dentro del directorio del plugin. Un atacante de red no autenticado puede enviar secuencias “.. / ” codificadas en porcentaje (“%2e%2e%2f”) que se decodifican en el parámetro de ruta y escapan del directorio del plugin, permitiendo la recuperación de archivos arbitrarios legibles por el proceso de backend de Theia. Los ID de plugin se derivan de forma determinista del editor y el nombre de un plugin, por lo que los plugins integrados sirven como anclajes fiables que no requieren conocimiento previo del sistema objetivo."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "Eclipse Foundation",
          "product": "Eclipse Theia",
          "defaultStatus": "unaffected",
          "versions": [
            {
              "version": "1.66.0",
              "lessThan": "1.74.0",
              "versionType": "semver",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
          "baseScore": 7.5,
          "baseSeverity": "HIGH",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "NONE",
          "availabilityImpact": "NONE"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 3.6
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-08-05T13:03:16.183383Z",
          "id": "CVE-2026-12609",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-22"
        }
      ]
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:eclipse:theia:*:*:*:*:*:*:*:*",
              "versionStartIncluding": "1.66.0",
              "versionEndExcluding": "1.74.0",
              "matchCriteriaId": "80478E2F-D9E2-4668-86CF-67913770E0AC"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/eclipse-theia/theia/security/advisories/GHSA-qmm6-p8q4-2g48",
      "source": "[email protected]",
      "tags": [
        "Broken Link"
      ]
    },
    {
      "url": "https://gitlab.eclipse.org/security/cve-assignment/-/work_items/133",
      "source": "[email protected]",
      "tags": [
        "Vendor Advisory"
      ]
    },
    {
      "url": "https://gitlab.eclipse.org/security/vulnerability-reports/-/issues/524",
      "source": "[email protected]",
      "tags": [
        "Issue Tracking",
        "Mitigation",
        "Vendor Advisory"
      ]
    }
  ]
}