The backend of Eclipse Theia binds the POST /file-upload endpoint in every filesystem‐enabled deployment. The handler accepts an attacker‑supplied absolute path from the multipart 'uri' field and calls fs.move(tmp, target, { overwrite: true }) without any workspace confinement or authentication. In browser (non‑Electron) deployments, the connection token is only enforced for WebSocket upgrades; the HTTP middleware reissues the cookie and allows the request to proceed. Because multipart/form‑data is a CORS‑safelisted request type, a cross‑origin web page can trigger the write with no preflight and no credentials, leading to an unauthenticated arbitrary file write to any absolute path that the backend process can write. This flaw can be leveraged to modify startup‑executed files such as ~/.bashrc, providing a path to remote code execution.

This issue affects Eclipse Theia versions up to and including 1.73.1. No third‑party products or later versions are listed.

The CVSS score is 8.8, indicating high severity. EPSS is not available, so the current exploitation probability can’t be quantified, but the lack of authentication and the ability to trigger the endpoint from a cross‑origin browser make the attack realistic. The issue is not listed in the CISA KEV catalog. Exploitation requires only a crafted multipart request and a server hosting a vulnerable Theia instance; Electron mode is immune via its separate security token.