CVE-2026-32847: DeepCode 1.2.0 Path Traversal via SPA Catch-All Route in main.py

Synopsis

A path traversal vulnerability in DeepCode 1.2.0 allows unauthenticated remote attackers to read arbitrary files from the host filesystem. The flaw exists in the SPA catch-all route in new_ui/backend/main.py, where percent-encoded path segments (slashes as %2F, dots as %2E%2E) bypass Starlette's path normalization and escape the intended FRONTEND_DIST directory. Successful exploitation gives an attacker direct read access to sensitive files such as SSH private keys, TLS certificates, and application secrets via a single HTTP GET request. No fix version has been published; HarborGuard tracks this advisory for patch availability.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable endpoint is exposed over the network; an attacker must be able to send HTTP GET requests to the DeepCode backend service.

• AuthenticationNot required

  No credentials or session token are needed; the vulnerable catch-all route accepts unauthenticated requests.

• Victim interactionNot required

  Exploitation is fully attacker-driven and requires no action from any user of the affected system.

• Attack complexityDetail

  The exploit is reliable and condition-free; encoding slashes and dots in the request path is sufficient to trigger the traversal with no race condition or environmental dependency.

Blast Radius

• Reads arbitrary files from the host filesystem accessible to the DeepCode process, including SSH private keys and TLS certificates.
• Reads application secrets and configuration files stored outside the FRONTEND_DIST directory, such as environment files and credential stores.
• Exposes any file readable by the server process user, enabling downstream credential theft or lateral movement using harvested key material.