CVE-2025-32431
📋 TL;DR
Traefik reverse proxy versions before 2.11.24, 3.3.6, and 3.4.0-rc2 contain a path traversal vulnerability in path-based routing matchers. Attackers can bypass middleware security controls and access unauthorized backends by injecting /../ sequences in URLs. This affects all Traefik deployments using PathPrefix, Path, or PathRegex matchers for routing.
💻 Affected Systems
- Traefik
📦 What is this software?
Traefik by Traefik
Traefik by Traefik
Traefik by Traefik
Traefik by Traefik
⚠️ Risk & Real-World Impact
Worst Case
Complete bypass of authentication, authorization, and security middleware, allowing direct access to internal services that should be protected, potentially leading to data breaches or lateral movement.
Likely Case
Unauthorized access to backend services that should be protected by middleware, potentially exposing sensitive data or functionality.
If Mitigated
Limited impact if proper network segmentation and additional authentication layers exist, but still represents a security control bypass.
🎯 Exploit Status
Exploitation requires only HTTP requests with crafted URLs containing /../ sequences. No authentication or special privileges needed.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 2.11.24, 3.3.6, or 3.4.0-rc2
Vendor Advisory: https://github.com/traefik/traefik/security/advisories/GHSA-6p68-w45g-48j7
Restart Required: Yes
Instructions:
1. Identify your Traefik version. 2. Upgrade to 2.11.24 (for v2), 3.3.6 (for v3 stable), or 3.4.0-rc2 (for v3 development). 3. Restart Traefik service. 4. Verify the upgrade was successful.
🔧 Temporary Workarounds
PathRegexp filter for /../
allAdd a PathRegexp rule to prevent matching routes containing /../ sequences
Add `PathRegexp(`^((?!\.\.).)*$`)` to your router matchers
🧯 If You Can't Patch
- Implement network-level controls to restrict access to vulnerable Traefik instances
- Add additional authentication/authorization layers at backend services
🔍 How to Verify
Check if Vulnerable:
Check Traefik version and configuration for path-based routing matchers. Test with crafted URLs containing /../ sequences.Check Version:
traefik versionVerify Fix Applied:
After patching, test that URLs with /../ sequences no longer bypass middleware and are properly rejected or normalized.📡 Detection & Monitoring
Log Indicators:
- HTTP requests containing /../ sequences in URLs
- Unexpected backend service access patterns
- Middleware bypass events
Network Indicators:
- HTTP traffic with encoded /../ sequences (%2F..%2F)
- Requests to unexpected backend endpoints
SIEM Query:
http.url:*%2F..%2F* OR http.url:*/../*