TI-2026-25310 CVE-2026-32847 · GHSA-2vjv-m9hw-qvjfDeepCode 1.2.0 Path Traversal via SPA Catch-All Route in main.pyPriority HIGH 77DeepCode through commit c991dc2 contains a path traversal vulnerability in the SPA catch-all route in new_ui/backend/main.py that allows unauthenticated attackers to read arbitrary files by supplying percent-encoded path…CVSS 4.0HIGH 8.7· Network · No auth · No interaction · EPSS 0.00376 · Published 2026-05-28 · No fix listed CWE-22