CVE-2026-32847: DeepCode 1.2.0 Path Traversal via SPA Catch-All Route in main.py
DeepCode through commit c991dc2 contains a path traversal vulnerability in the SPA catch-all route in newui/backend/main.py that allows unauthenticated attackers to read arbitrary files by supplying percent-encoded path segments to the GET /{fullpath:path} endpoint. Attackers can bypass Starlette's path normalization by encoding slashes as %2F and dots as %2E%2E, causing the joined path to traverse outside FRONTENDDIST and exposing sensitive files such as SSH private keys, TLS certificates, and application secrets with a single HTTP request.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Remove
Remove
DeepCode new_ui/backend/main.py (SPA catch-all route)from your environment.If the SPA catch-all route is not required for application functionality, remove/uninstall the catch-all route implementation to eliminate the attack surface until a proper code fix is deployed.
- Configuration
Before joining the requested full_path to FRONTEND_DIST, percent-decode and canonicalize the path (remove ../ components). If the resolved path is outside FRONTEND_DIST, return a 403/404. Explicitly detect and reject percent-encoded path separators (%2F) and encoded dot sequences (%2E / %2E%2E) in the full_path parameter.
DeepCode new_ui/backend/main.py (SPA catch-all route) GET /{full_path:path} handling = Reject percent-encoded slashes (%2F) and percent-encoded dot sequences (%2E, %2E%2E); ensure percent-decoding and canonicalization occur before joining with FRONTEND_DIST and verify the resolved path remains inside FRONTEND_DIST - Compensating control
Until the code is fixed, restrict access to the SPA catch-all endpoint (GET /{full_path:path}) to trusted/internal IPs or require authentication. Apply firewall, reverse-proxy, or WAF rules to block external unauthenticated requests to this endpoint.
- Operational
If the vulnerable endpoint was reachable, rotate any potentially exposed secrets (SSH private keys, TLS certificates, application secrets) and replace impacted credentials. Review access logs for requests containing percent-encoded sequences such as %2F and %2E to identify possible unauthorized file reads and investigate any suspicious activity.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-32847?
CVE-2026-32847 has a high severity rating of 7.5.
What type of vulnerability is CVE-2026-32847?
CVE-2026-32847 is a Path Traversal vulnerability.
How do I fix CVE-2026-32847?
To fix CVE-2026-32847, ensure that user input is properly validated and sanitized to prevent arbitrary file access.
Who is affected by CVE-2026-32847?
CVE-2026-32847 affects users of DeepCode version 1.2.0.
What impact does CVE-2026-32847 have?
CVE-2026-32847 allows unauthenticated attackers to read arbitrary files from the system.