← CVE Radar
CVE-2026-121967Coder before 2.29.22, 2.34.13, 2.35.10, 2.36.8, 2.37.5, and 2.38.1 AI Gateway Path Traversal
Coder 2.28.0 before 2.29.22, 2.30.0 before 2.34.13, 2.35.0 before 2.35.10, 2.36.0 before 2.36.8, 2.37.0 before 2.37.5, and 2.38.0 before 2.38.1 contains a path traversal vulnerability in the AI Gateway passthrough router, which forwards percent-encoded dot segments upstream without rejecting them. Authenticated users can send paths such as %2e%2e or ..%2F under allowlisted prefixes to reach unintended provider endpoints using the deployment's centrally managed provider key.
2.3 LOWEPSS 0.25%Not in KEVNVD: Received
Overview
Severity
| Score | Severity | Version | Vector String |
|---|---|---|---|
| 2.3 | LOW | 4.0VulnCheck (CNA) | CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N |
| 4.9 | MEDIUM | 3.1VulnCheck (CNA) | CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:N |
Details
- CVE ID
- CVE-2026-121967
- Status
- Received
- Assigner (CNA)
- VulnCheck
- Published
- Nov 4, 2026
- Last modified
- 2026-11-04 19:17 UTC
- Weaknesses
- CWE-22 · Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Affected Products
As published by the CNA in the CVE record.
codercoder1 version range
- 2.37.0 before 2.37.5
codercoder1 version range
- 2.36.0 before 2.36.8
codercoder1 version range
- 2.35.0 before 2.35.10
codercoder1 version range
- 2.30.0 before 2.34.13
codercoder1 version range
- 2.28.0 before 2.29.22
codercoder1 version range
- 2.38.0 before 2.38.1