CVE-2026-61891

{
  "id": "CVE-2026-61891",
  "sourceIdentifier": "[email protected]",
  "published": "2026-08-05T12:18:57.310",
  "lastModified": "2026-10-24T16:10:00.153",
  "vulnStatus": "Analyzed",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "In Eclipse Theia versions up to and including 1.73.1, the `@theia/filesystem` backend exposes HTTP file-download endpoints (`GET /file`, `GET /files/`, `PUT /files/`) that convert a client-supplied URI directly to a filesystem path and stream the file, without confining it to the workspace or any allow-listed root. In browser (non-Electron) deployments the connection token is enforced only on WebSocket upgrades; the HTTP middleware in `@theia/core` re-issues the cookie and calls `next()` without rejecting tokenless HTTP requests, so these endpoints are reachable without a valid token. As a result an unauthenticated client can read any file readable by the backend process, including files outside the opened workspace (for example `/etc/hosts`, SSH keys, or tokens). Electron mode uses a separate `ElectronSecurityToken` and is not affected via this path."
    },
    {
      "lang": "es",
      "value": "En las versiones de Eclipse Theia hasta la 1.73.1 inclusive, el backend “@theia/filesystem” expone puntos finales de descarga de archivos HTTP (’GET /file’, ’GET /files/’, ’PUT /files/’) que convierten una URI proporcionada por el cliente directamente en una ruta del sistema de archivos y transmiten el archivo, sin confinarlo al espacio de trabajo ni a ninguna raíz permitida. En despliegues de navegador (no Electron), el token de conexión se aplica solo en las actualizaciones de WebSocket; el middleware HTTP en “@theia/core” reemite la cookie y llama a “next()” sin rechazar las solicitudes HTTP sin token, por lo que estos puntos finales son accesibles sin un token válido. Como resultado, un cliente no autenticado puede leer cualquier archivo legible por el proceso de backend, incluyendo archivos fuera del espacio de trabajo abierto (por ejemplo, ’/etc/h0sts’, claves SSH o tokens). El modo Electron utiliza un “ElectronSecurityToken” separado y no se ve afectado por esta ruta."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "Eclipse Foundation",
          "product": "Eclipse Theia",
          "defaultStatus": "unaffected",
          "versions": [
            {
              "version": "0",
              "lessThan": "1.74.0",
              "versionType": "semver",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
          "baseScore": 7.5,
          "baseSeverity": "HIGH",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "NONE",
          "availabilityImpact": "NONE"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 3.6
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-08-05T12:34:58.985421Z",
          "id": "CVE-2026-61891",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-22"
        },
        {
          "lang": "en",
          "value": "CWE-36"
        },
        {
          "lang": "en",
          "value": "CWE-200"
        },
        {
          "lang": "en",
          "value": "CWE-306"
        }
      ]
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:eclipse:theia:*:*:*:*:*:*:*:*",
              "versionEndExcluding": "1.74.0",
              "matchCriteriaId": "670EAAD9-2B91-4846-B5B2-09E075AACF1F"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/eclipse-theia/theia/security/advisories/GHSA-qqc8-9538-25v4",
      "source": "[email protected]",
      "tags": [
        "Broken Link"
      ]
    },
    {
      "url": "https://gitlab.eclipse.org/security/cve-assignment/-/work_items/176",
      "source": "[email protected]",
      "tags": [
        "Vendor Advisory"
      ]
    },
    {
      "url": "https://gitlab.eclipse.org/security/vulnerability-reports/-/issues/570",
      "source": "[email protected]",
      "tags": [
        "Issue Tracking",
        "Vendor Advisory"
      ]
    }
  ]
}