GHSA-c6h5-pw77-hjcpLowCVSS 4.9
Coder 2.28.0 before 2.29.22, 2.30.0 before 2.34.13, 2.35.0 before 2.35.10, 2.36.0 before 2.36.8,...
🔗 CVE IDs covered (1)
📋 Description
Coder 2.28.0 before 2.29.22, 2.30.0 before 2.34.13, 2.35.0 before 2.35.10, 2.36.0 before 2.36.8, 2.37.0 before 2.37.5, and 2.38.0 before 2.38.1 contains a path traversal vulnerability in the AI Gateway passthrough router, which forwards percent-encoded dot segments upstream without rejecting them. Authenticated users can send paths such as %2e%2e or ..%2F under allowlisted prefixes to reach unintended provider endpoints using the deployment's centrally managed provider key.
🔗 References (5)
- https://github.com/coder/coder/security/advisories/GHSA-373r-678h-hjc6
- https://nvd.nist.gov/vuln/detail/CVE-2026-121967
- https://github.com/coder/coder/pull/30178
- https://www.vulncheck.com/advisories/coder-before-2.29.22-2.34.13-2.35.10-2.36.8-2.37.5-and-2.38.1-ai-gateway-path-traversal
- https://github.com/advisories/GHSA-c6h5-pw77-hjcp