CVE-2025-32431

Traefik has a possible vulnerability with the path matchers

Severity Score

8.8

*CVSS v4

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

*Multiple Sources

Exploited in Wild

*KEV

Decision

Attend

*SSVC

Descriptions

Traefik (pronounced traffic) is an HTTP reverse proxy and load balancer. In versions prior to 2.11.24, 3.3.6, and 3.4.0-rc2. There is a potential vulnerability in Traefik managing the requests using a PathPrefix, Path or PathRegex matcher. When Traefik is configured to route the requests to a backend using a matcher based on the path, if the URL contains a /../ in its path, it’s possible to target a backend, exposed using another router, by-passing the middlewares chain. This issue has been patched in versions 2.11.24, 3.3.6, and 3.4.0-rc2. A workaround involves adding a `PathRegexp` rule to the matcher to prevent matching a route with a `/../` in the path.

Traefik (pronunciado "traffic") es un proxy inverso HTTP y balanceador de carga. En versiones anteriores a 2.11.24, 3.3.6 y 3.4.0-rc2, existe una vulnerabilidad potencial en Traefik al gestionar las solicitudes mediante un comparador PathPrefix, Path o PathRegex. Cuando Traefik se configura para enrutar las solicitudes a un backend mediante un comparador basado en la ruta, si la URL contiene un /../ en su ruta, es posible dirigirse a un backend expuesto mediante otro enrutador, omitiendo la cadena de middleware. Este problema se ha corregido en las versiones 2.11.24, 3.3.6 y 3.4.0-rc2. Un workaround consiste en añadir una regla `PathRegexp` al comparador para evitar que coincida con una ruta que contenga un `/../` en la ruta.

*Credits: N/A

CVSS Scores

Attack Vector

Network

Attack Complexity

Low

Attack Requirements

None

Privileges Required

None

User Interaction

None

System

Vulnerable | Subsequent

Confidentiality

High

None

Integrity

High

None

Availability

None

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Attack Vector

Network

Attack Complexity

Low

Authentication

None

Confidentiality

Partial

Integrity

None

Availability

None

* Common Vulnerability Scoring System

SSVC

Decision:Attend

Exploitation

None

Automatable

Yes

Tech. Impact

Total

* Organization's Worst-case Scenario

Timeline

2025-04-08 CVE Reserved
2025-04-21 CVE Published
2025-04-23 CVE Updated
2025-05-23 EPSS Updated
---------- Exploited in Wild
---------- KEV Due Date
---------- First Exploit

CWE

CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CAPEC

References (5)

URL	Tag	Source
https://github.com/traefik/traefik/pull/11684	X_refsource_misc
https://github.com/traefik/traefik/releases/tag/v2.11.24	X_refsource_misc
https://github.com/traefik/traefik/releases/tag/v3.3.6	X_refsource_misc
https://github.com/traefik/traefik/releases/tag/v3.4.0-rc2	X_refsource_misc
https://github.com/traefik/traefik/security/advisories/GHSA-6p68-w45g-48j7	X_refsource_confirm

URL	Date	SRC

URL	Date	SRC

URL	Date	SRC

Affected Vendors, Products, and Versions

Vendor		Product				Version		Other		Status
Vendor	Product	Version	Other	Status	<-- -->	Vendor	Product	Version	Other	Status
Traefik Search vendor "Traefik"		Traefik Search vendor "Traefik" for product "Traefik"				< 2.11.24 Search vendor "Traefik" for product "Traefik" and version " < 2.11.24"		en		Affected
Traefik Search vendor "Traefik"		Traefik Search vendor "Traefik" for product "Traefik"				< 3.3.6 Search vendor "Traefik" for product "Traefik" and version " < 3.3.6"		en		Affected
Traefik Search vendor "Traefik"		Traefik Search vendor "Traefik" for product "Traefik"				3.4.0 Search vendor "Traefik" for product "Traefik" and version "3.4.0"		en		Affected