Reference page — cumulative record through Wednesday, August 19, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.
AV AC AT PR UI VC VI VA CVSS EPSS %ile KEV N L N N N H N N 8.7 .0038 30.9 —
AFFECTED Product Versions Fixed DeepCode unspecified —
TIMELINE Mar 16 Reserved by VulnCheck May 28 EXPLOIT PUBLISHED — CVE-2026-32847 (HKUDS DeepCode). Public exploit reference added. May 28 Published (CNA: VulnCheck)
DeepCode through commit c991dc2 contains a path traversal vulnerability in the SPA catch-all route in new_ui/backend/main.py that allows unauthenticated attackers to read arbitrary files by supplying percent-encoded path segments to the GET /{full_path:path} endpoint. Attackers can bypass Starlette's path normalization by encoding slashes as %2F and dots as %2E%2E, causing the joined path to traverse outside FRONTEND_DIST and exposing sensitive files such as SSH private keys, TLS certificates, and application secrets with a single HTTP request.
| Date | Event | Detail |
|---|---|---|
| March 16, 2026 | Reserved | Reserved by VulnCheck |
| May 28, 2026 | EXPLOIT PUBLISHED | EXPLOIT PUBLISHED — CVE-2026-32847 (HKUDS DeepCode). Public exploit reference added. |
| May 28, 2026 | Published | Published (CNA: VulnCheck) |
| Vendor | Product / Package | Ecosystem | Version introduced | Fixed |
|---|---|---|---|---|
| HKUDS | DeepCode | — | — | — |
Authoritative record: CVE-2026-32847 at cve.org
Vendors: hkuds
Weaknesses: CWE-22
This is a reference page, not a dated page of record. It assembles the complete lifecycle of CVE-2026-32847 from the CVE Program record, NVD enrichment, the CISA KEV catalog, EPSS, and OSV advisories. The box score's numbers (CVSS, EPSS, KEV status) are current as of Wednesday, August 19, 2026 UTC and are re-derived as the archive grows; only dated daily editions are immutable pages of record. The authoritative source for this identifier is cve.org.