A path traversal vulnerability exists in the SPA catch‑all route of DeepCode’s main.py. Because the path normalization performed by Starlette can be bypassed with specially encoded segments, unauthenticated users can request the GET /{full_path:path} endpoint with percent‑encoded slashes (%2F) and dots (%2E%2E). The server then joins the supplied path with FRONTEND_DIST and serves the file, allowing read of arbitrary files on the host, including SSH private keys, TLS certificates, and application secrets.

The vulnerability affects installations of DeepCode from HKUDS, version 1.2.0 that contain the commit c991dc2 where the SPA catch‑all route is defined. Any deployment that has not applied the fix in this commit is vulnerable.

The CVSS score of 8.7 indicates a high severity, and the attack can be performed remotely via a single HTTP GET request without authentication. Because the EPSS score is not available and the issue is not listed in the CISA KEV catalog, the current risk is based solely on the high CVSS and the ease of exploitation via crafted URLs that bypass path normalization.