CVE-2025-32431
Severity CVSS v4.0:
HIGH
Type:
CWE-22
Path Traversal
Publication date:
21/04/2025
Last modified:
25/11/2025
Description
Traefik (pronounced traffic) is an HTTP reverse proxy and load balancer. In versions prior to 2.11.24, 3.3.6, and 3.4.0-rc2. There is a potential vulnerability in Traefik managing the requests using a PathPrefix, Path or PathRegex matcher. When Traefik is configured to route the requests to a backend using a matcher based on the path, if the URL contains a /../ in its path, it’s possible to target a backend, exposed using another router, by-passing the middlewares chain. This issue has been patched in versions 2.11.24, 3.3.6, and 3.4.0-rc2. A workaround involves adding a `PathRegexp` rule to the matcher to prevent matching a route with a `/../` in the path.
Impact
Base Score 4.0
8.80
Severity 4.0
HIGH
Base Score 3.x
9.10
Severity 3.x
CRITICAL
Vulnerable products and versions
| CPE | From | Up to |
|---|---|---|
| cpe:2.3:a:traefik:traefik:*:*:*:*:*:*:*:* | 2.11.24 (excluding) | |
| cpe:2.3:a:traefik:traefik:*:*:*:*:*:*:*:* | 3.0.0 (including) | 3.3.6 (excluding) |
| cpe:2.3:a:traefik:traefik:3.4.0:-:*:*:*:*:*:* | ||
| cpe:2.3:a:traefik:traefik:3.4.0:rc1:*:*:*:*:*:* |
To consult the complete list of CPE names with products and versions, see this page