In Eclipse Theia versions up to and including 1.73.1, the `@theia/filesystem` backend binds `POST /file-upload` in every filesystem-enabled deployment. The hand…

Eclipse Theia versions up to and including 1.73.1 contain a critical vulnerability in the @theia/filesystem backend where the POST /file-upload endpoint accepts attacker-supplied absolute paths with no authentication or workspace confinement. The handler calls fs.move() with overwrite enabled, allowing writes to any path the backend process can access. In browser (non-Electron) deployments, the connection token is only enforced on WebSocket upgrades, leaving HTTP endpoints unprotected. Because multipart/form-data is a CORS-safelisted content type, cross-origin pages can trigger the file write without preflight requests or credentials. This enables unauthenticated arbitrary file write that can escalate to remote code execution by overwriting startup files such as ~/.bashrc. Electron deployments using ElectronSecurityToken are not affected by this specific attack path. The vulnerability poses a critical risk to any browser-based Eclipse Theia deployment exposed to untrusted web content.