Critical severity · published Aug 2, 2025
CVE-2025-54386
Traefik is an HTTP reverse proxy and load balancer
9.8
CVSS
1.3%
EPSS
No
On KEV
Description
Traefik is an HTTP reverse proxy and load balancer. In versions 2.11.27 and below, 3.0.0 through 3.4.4 and 3.5.0-rc1, a path traversal vulnerability was discovered in WASM Traefik’s plugin installation mechanism. By supplying a maliciously crafted ZIP archive containing file paths with ../ sequences, an attacker can overwrite arbitrary files on the system outside of the intended plugin directory. This can lead to remote code execution (RCE), privilege escalation, persistence, or denial of service. This is fixed in versions 2.11.28, 3.4.5 and 3.5.0.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.3% · higher than 70% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
TR
Traefik · Traefik
before 2.11.7; 3.0.0 before 3.4.4; 3.5.0; 3.5.0; 3.5.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-54386
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-54386
Patch
https://github.com/traefik/plugin-service/pull/71
Patch
https://github.com/traefik/plugin-service/pull/72
Patch
https://github.com/traefik/traefik/commit/5ef853a0c53068f69a6c229a5815a0dc6e0a8800
Patch
https://github.com/traefik/traefik/pull/11911
Release Notes
https://github.com/traefik/traefik/releases/tag/v2.11.28
Vendor Advisory
https://github.com/traefik/traefik/security/advisories/GHSA-q6gg-9f92-r9wg
More from Traefik
10.0
CVE-2026-54763
Traefik: headerField underscore-variant identity spoofing in BasicAuth / DigestAuth / ForwardAuth
10.0
CVE-2026-53622
Traefik: HTTP/3 mTLS bypass via exact SNI TLSOptions lookup for wildcard and mixed-case hosts
10.0
CVE-2026-48491
Traefik: SNICheck ignores wildcard TLSOptions mappings, allowing domain-fronted mTLS bypass
10.0
CVE-2026-48020
Traefik StripPrefix Route-Level Auth Bypass via Path Normalization
10.0
CVE-2026-39858
Traefik: Forwarded alias spoofing top pre-auth decision bypass