The Eclipse Theia backend exposes a /hostedPlugin endpoint that resolves requested paths using path.resolve without validating that the resolved path stays inside the plugin’s directory. An unauthenticated attacker can send percent‑encoded ../ sequences that decode to directory traversal characters, enabling the download of any file readable by the backend process. The weakness allows arbitrary file read and therefore a severe confidentiality breach. Its root cause is a path traversal flaw, identified as CWE-22.

Eclipse Foundation’s Eclipse Theia, versions 1.66.0 through 1.73.1, are affected. Built‑in plugins provide deterministic identifiers that an attacker can target without prior system knowledge.

The CVSS score of 7.5 indicates a high‑severity vulnerability. Exploration score is not available, but the vulnerability is publicly exploitable via a simple crafted HTTP request, and it is not listed in CISA’s KEV catalog. An attacker can reach the vulnerable endpoint from any network location that can contact the Theia instance, so the likelihood of exploitation is high when no additional controls are in place.