In Eclipse Theia versions up to and including 1.73.1, the `@theia/filesystem` backend exposes HTTP file-download endpoints (`GET /file`, `GET /files/`, `PUT /fi…

CVE-2026-61891 affects Eclipse Theia versions up to and including 1.73.1, where the @theia/filesystem backend exposes HTTP file-download endpoints without proper authentication or path confinement. The affected endpoints (GET /file, GET /files/, PUT /files/) accept client-supplied URIs and convert them directly to filesystem paths without restricting access to the workspace. In browser-based (non-Electron) deployments, the connection token is only enforced on WebSocket upgrades, while HTTP middleware re-issues cookies and calls next() without rejecting tokenless requests. This allows unauthenticated attackers to read any file accessible by the backend process, including sensitive files outside the workspace such as /etc/hosts, SSH keys, and authentication tokens. Electron deployments using ElectronSecurityToken are not affected by this specific vulnerability path. The issue represents a path traversal and authentication bypass combination with high impact on confidentiality.