The vulnerability exists in the new_ui/backend/main.py file of DeepCode, where the SPA catch-all route at GET /{full_path:path} improperly limits pathnames to a restricted directory. Attackers can encode slashes (%2F) and dots (%2E%2E) to bypass Starlette's path normalization, enabling traversal outside the intended FRONTEND_DIST directory. This allows reading of arbitrary files, including sensitive credentials and secrets, without authentication.

Successful exploitation allows unauthenticated attackers to read arbitrary files on the server, potentially exposing sensitive information such as SSH private keys, TLS certificates, and application secrets. This can lead to further compromise of the system or its communications. The CVSS 4.0 score of 8.7 reflects a high-impact vulnerability with network attack vector, no required privileges or user interaction, and high confidentiality impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the affected endpoint if possible and monitor for suspicious requests attempting path traversal with encoded characters. Avoid exposing sensitive files in directories accessible by the web server.