Eclipse Theia’s filesystem backend allows a client‑supplied URI to be converted directly to a filesystem path and streamed over HTTP endpoints without confining the path to the workspace. The backend also does not require a valid authentication token for these HTTP routes, permitting an unauthenticated client to read any file that the backend process can access. This results in confidentiality compromise of arbitrary files, including system configuration, SSH keys, or tokens. The weakness is rooted in a lack of access control and path traversal safeguards and is reflected in CWE‑200, CWE‑22, CWE‑306, and CWE‑36.

The vulnerability is present in all Eclipse Theia releases up to and including 1.73.1. Applications deployed in browser mode (non‑Electron) are affected; Electron mode uses a separate security token and is not impacted through this HTTP path. Users running any affected version should verify the installed version and upgrade if necessary.

The CVSS score of 7.5 indicates high severity. The EPSS score is not available, but the vulnerability is not listed in CISA KEV. Attackers can exploit the flaw by sending unauthenticated HTTP GET or PUT requests to the exposed endpoints from a browser. Once authenticated via WebSocket, the HTTP middleware re‑issues the cookie and permits the request, allowing file disclosure. The impact is limited to confidentiality, but the extensive range of readable files could lead to credential theft or system compromise.