In Eclipse Theia versions 1.66.0 and up until including 1.73.1, the `@theia\/plugin-ext` backend exposes the `\/hostedPlugin\/:pluginId\/:path(*)` HTTP endpoint, which resolves the requested file path with `path.resolve(localPath, filePath)` without verifying that the resolved path stays within the plugin’s directory. An unauthenticated network attacker can send percent-encoded `..\/` sequences (`%2e%2e%2f`) that decode into the path parameter and escape the plugin directory, allowing arbitrary files readable by the Theia backend process to be retrieved. Plugin IDs are derived deterministically from a plugin’s publisher and name, so built-in plugins serve as reliable anchors that require no prior knowledge of the target system.<\/p>\n","protected":false},"excerpt":{"rendered":"
In Eclipse Theia versions 1.66.0 and up until including 1.73.1, the `@theia\/plugin-ext` backend exposes the `\/hostedPlugin\/:pluginId\/:path(*)` HTTP endpoint, which resolves the requested file path wit<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-4680","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/4680","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=4680"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=4680"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=4680"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}