@codeanywhere/theia-plugin-ext (>=1.11.0, <=1.11.4), @devpodio/github-extension (1.0.0) +144 more potentially affected by CVE-2026-60009 via @theia/filesystem (>=1.0.0, <=1.74.0-next.70)

@theia/filesystem NPM version =1.0.0, =1.11.0, =0.1.7, =0.0.1-1585667205, =0.8.0-next.6917503, =0.0.1-next.20220331.125641, =0.0.5, =0.1.0-alpha.3ddb00f8, =0.2.0-next.25250370, =0.7.1, =0.9.1 and more Source cves: CVE-2026-60009 Source advisory: SNYK:JS-THEIAFILESYSTEM-18565056...

Cross-site Request Forgery (CSRF)

Overview @theia/filesystem is a Theia - FileSystem Extension Affected versions of this package are vulnerable to Cross-site Request Forgery CSRF through the NodeFileUploadService handler in the filesystem backend code. An attacker can overwrite any filesystem path the backend process can write by...

CVE-2026-60009

In Eclipse Theia versions up to and including 1.73.1, the @theia/filesystem backend binds POST /file-upload in every filesystem-enabled deployment. The handler takes an attacker-supplied absolute path from the multipart uri field and calls fs.movetmp, target, overwrite: true with no workspace...

CVE-2026-61891

CVE-2026-61891 affects Eclipse Theia up to 1.73.1, specifically the @theia/filesystem backend. The HTTP endpoints GET /file, GET /files/, and PUT /files/ map a client-supplied URI directly to a filesystem path and stream the file, without confinement to the workspace or any allow-listed root. In ...

CVE-2026-61891

In Eclipse Theia versions up to and including 1.73.1, the @theia/filesystem backend exposes HTTP file-download endpoints GET /file, GET /files/, PUT /files/ that convert a client-supplied URI directly to a filesystem path and stream the file, without confining it to the workspace or any...

@codeanywhere/theia-plugin-ext (>=1.11.0, <=1.11.4), @devpodio/github-extension (1.0.0) +187 more potentially affected by CVE-2026-61891 via @theia/filesystem (>=0.1.1, <=1.74.0-next.70)

@theia/filesystem NPM version =0.1.1, =1.11.0, =0.1.7, =0.0.1, =0.0.1-1530128588, =0.0.1-1569582204, =0.7.0, =0.0.1-next.20220331.125641, =0.0.5, =0.1.0-alpha.3ddb00f8, =0.1.0-next.f008ff69 - @fangoling/ai-terminal-assistant 0.1.0 and more Source cves: CVE-2026-61891 Source advisory:...

@codeanywhere/theia-plugin-ext (>=1.11.0, <=1.11.4), @devpodio/github-extension (1.0.0) +187 more potentially affected by CVE-2026-60009 via @theia/filesystem (>=0.1.1, <=1.74.0-next.70)

@theia/filesystem NPM version =0.1.1, =1.11.0, =0.1.7, =0.0.1, =0.0.1-1530128588, =0.0.1-1569582204, =0.7.0, =0.0.1-next.20220331.125641, =0.0.5, =0.1.0-alpha.3ddb00f8, =0.1.0-next.f008ff69 - @fangoling/ai-terminal-assistant 0.1.0 and more Source cves: CVE-2026-60009 Source advisory:...

CVE-2026-60009

In Eclipse Theia versions up to and including 1.73.1, the @theia/filesystem backend binds POST /file-upload in every filesystem-enabled deployment. The handler takes an attacker-supplied absolute path from the multipart uri field and calls fs.movetmp, target, overwrite: true with no workspace...

PT-2026-68121

Name of the Vulnerable Software and Affected Versions Eclipse Theia versions prior to 1.73.2 Description The @theia/filesystem backend exposes HTTP file-download endpoints GET /file, GET /files/, and PUT /files/ that convert a client-supplied URI directly to a filesystem path and stream the file...

CVE-2026-61891: Improper Limitation of a Pathname to a Restricted Directory

In Eclipse Theia versions up to and including 1.73.1, the @theia/filesystem backend exposes HTTP file-download endpoints GET /file, GET /files/, PUT /files/ that convert a client-supplied URI directly to a filesystem path and stream the file, without confining it to the workspace or any...

CVE-2026-60009: Cross-Site Request Forgery (CSRF)

In Eclipse Theia versions up to and including 1.73.1, the @theia/filesystem backend binds POST /file-upload in every filesystem-enabled deployment. The handler takes an attacker-supplied absolute path from the multipart uri field and calls fs.movetmp, target, overwrite: true with no workspace...

PT-2026-68095

Name of the Vulnerable Software and Affected Versions Eclipse Theia versions prior to 1.73.2 Description The @theia/filesystem backend binds the 'POST /file-upload' endpoint in every filesystem-enabled deployment. The handler processes an absolute path provided by an attacker via the multipart ur...