CVE-2026-12609

In Eclipse Theia versions 1.66.0 and up until including 1.73.1, the "@theia/plugin-ext" backend exposes the "/hostedPlugin/:pluginId/:path" HTTP endpoint, which resolves the requested file path with "path.resolvelocalPath, filePath" without verifying that the resolved path stays within the plugin...

PT-2026-68091

Name of the Vulnerable Software and Affected Versions Eclipse Theia versions 1.66.0 through 1.73.1 Description The @theia/plugin-ext backend exposes the /hostedPlugin/:pluginId/:path HTTP endpoint. The system resolves the requested file path using the path.resolvelocalPath, filePath function...