In Eclipse Theia versions 1.66.0 and up until including 1.73.1, the `@theia/plugin-ext` backend exposes the `/hostedPlugin/:pluginId/:path(*)` HTTP endpoint, wh…

CVE-2026-12609 affects Eclipse Theia versions 1.66.0 through 1.73.1, where the @theia/plugin-ext backend exposes an HTTP endpoint vulnerable to path traversal. The endpoint resolves file paths using path.resolve() without validating that the result stays within the plugin directory. Unauthenticated remote attackers can send percent-encoded directory traversal sequences (%2e%2e%2f) to escape the plugin directory and read arbitrary files accessible by the Theia backend process. Because plugin IDs are deterministically derived from publisher and plugin name, built-in plugins can serve as reliable anchors, requiring no prior knowledge of the target system. This makes the vulnerability exploitable without authentication and without reconnaissance. The issue has been reported via GitHub Security Advisories and GitLab Eclipse security tracking systems.