Coder's AI Gateway contains a path traversal flaw that enables authenticated users to forward percent‑encoded dot segments such as %2e%2e or ..%2F. By appending these sequences beneath allowlisted prefixes, a user can reach provider endpoints that are not intended for that prefix, exposing configuration data or internal services. This flaw does not grant arbitrary code execution but allows a user with valid credentials to read or otherwise interact with unintended provider resources.

Any deployed instance of the Coder platform running versions 2.28.0 through 2.38.0 before the respective patch levels – 2.29.22, 2.34.13, 2.35.10, 2.36.8, 2.37.5, 2.38.1 – is vulnerable. The affected component is the AI Gateway passthrough router. The product is Coder, produced by the vendor coder.

The CVSS score of 2.3 indicates a low severity vulnerability. EPSS is not available, and the vulnerability is not listed in CISA's KEV catalog. The attack requires authenticated access to the Coder instance and knowledge of the allowlisted prefixes to craft the malicious path. Because it is limited to paths under permitted prefixes, the exposure is contained, yet an attacker could leverage the deployment’s centrally managed provider key to reach internal or external provider services, potentially leading to information disclosure or privilege abuse.