Description
Coder 2.28.0 before 2.29.22, 2.30.0 before 2.34.13, 2.35.0 before 2.35.10, 2.36.0 before 2.36.8, 2.37.0 before 2.37.5, and 2.38.0 before 2.38.1 contains a path traversal vulnerability in the AI Gateway passthrough router, which forwards percent-encoded dot segments upstream without rejecting them. Authenticated users can send paths such as %2e%2e or ..%2F under allowlisted prefixes to reach unintended provider endpoints using the deployment's centrally managed provider key.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| coder | coder | 2.37.0 – < 2.37.5, 2.36.0 – < 2.36.8, 2.35.0 – < 2.35.10, 2.30.0 – < 2.34.13, 2.28.0 – < 2.29.22, 2.38.0 – < 2.38.1 | 2.37.5 |
References
- GitHub Security Advisory (GHSA-373r-678h-hjc6) vendor-advisory
- GitHub Pull Request #30178 patch issue-tracking
- VulnCheck Advisory: Coder before 2.29.22, 2.34.13, 2.35.10, 2.36.8, 2.37.5, and 2.38.1 AI Gateway Path Traversal third-party-advisory