CVE-2026-12609

In Eclipse Theia versions 1.66.0 and up until including 1.73.1, the @theia/plugin-ext backend exposes the /hostedPlugin/:pluginId/:path HTTP endpoint, which resolves the requested file path with path.resolvelocalPath, filePath without verifying that the resolved path stays within the plugin's...

PT-2026-68091

Name of the Vulnerable Software and Affected Versions Eclipse Theia versions 1.66.0 through 1.73.1 Description The @theia/plugin-ext backend exposes the /hostedPlugin/:pluginId/:path HTTP endpoint. The system resolves the requested file path using the path.resolvelocalPath, filePath function...