CVE-2026-121967 PUBLISHED

Coder before 2.29.22, 2.34.13, 2.35.10, 2.36.8, 2.37.5, and 2.38.1 AI Gateway Path Traversal

Assigner: VulnCheck
Reserved: 04.11.2026 Published: 04.11.2026 Updated: 04.11.2026

Coder 2.28.0 before 2.29.22, 2.30.0 before 2.34.13, 2.35.0 before 2.35.10, 2.36.0 before 2.36.8, 2.37.0 before 2.37.5, and 2.38.0 before 2.38.1 contains a path traversal vulnerability in the AI Gateway passthrough router, which forwards percent-encoded dot segments upstream without rejecting them. Authenticated users can send paths such as %2e%2e or ..%2F under allowlisted prefixes to reach unintended provider endpoints using the deployment's centrally managed provider key.

Metrics

CVSS Vector: CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N
CVSS Score: 2.3

Product Status

Vendor coder
Product coder
Versions Default: unaffected
  • affected from 2.37.0 to 2.37.5 (excl.)
  • Version 2.37.5 is unaffected
Vendor coder
Product coder
Versions Default: unaffected
  • affected from 2.36.0 to 2.36.8 (excl.)
  • Version 2.36.8 is unaffected
Vendor coder
Product coder
Versions Default: unaffected
  • affected from 2.35.0 to 2.35.10 (excl.)
  • Version 2.35.10 is unaffected
Vendor coder
Product coder
Versions Default: unaffected
  • affected from 2.30.0 to 2.34.13 (excl.)
  • Version 2.34.13 is unaffected
Vendor coder
Product coder
Versions Default: unaffected
  • affected from 2.28.0 to 2.29.22 (excl.)
  • Version 2.29.22 is unaffected
Vendor coder
Product coder
Versions Default: unaffected
  • affected from 2.38.0 to 2.38.1 (excl.)
  • Version 2.38.1 is unaffected

References

Problem Types

  • Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') CWE