Vulnerability	Vulnerable Version
H Directory Traversal @theia/plugin-ext is a Theia - Plugin Extension Affected versions of this package are vulnerable to Directory Traversal through the `HostedPluginReader` in `plugin-reader`, specifically the `/hostedPlugin/:pluginId/:path(*)` resource handler. An attacker can read arbitrary files accessible to the Theia backend process by sending a request with percent-encoded `../` sequences or an absolute path that escapes the target plugin directory. The handler resolves the attacker-controlled path against the plugin’s local directory without enforcing that the final path stays inside that directory. This lets an unauthenticated network attacker retrieve readable files from the backend host, exposing plugin files and any other backend-readable local content. How to fix Directory Traversal? Upgrade `@theia/plugin-ext` to version 1.74.0 or higher.	>=1.66.0 <1.74.0

Directory Traversal

@theia/plugin-ext is a Theia - Plugin Extension

Affected versions of this package are vulnerable to Directory Traversal through the HostedPluginReader in plugin-reader, specifically the /hostedPlugin/:pluginId/:path(*) resource handler. An attacker can read arbitrary files accessible to the Theia backend process by sending a request with percent-encoded ../ sequences or an absolute path that escapes the target plugin directory. The handler resolves the attacker-controlled path against the plugin’s local directory without enforcing that the final path stays inside that directory. This lets an unauthenticated network attacker retrieve readable files from the backend host, exposing plugin files and any other backend-readable local content.

How to fix Directory Traversal?

Upgrade @theia/plugin-ext to version 1.74.0 or higher.

>=1.66.0 <1.74.0

Go back to all versions of this package