Traefik's Client Plugin is Vulnerable to Path Traversal, Arbitrary File Overwrites and Remote Code Execution
Priority LOW 37CWE-22Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- High
- User interaction
- Passive
- Attack complexity
- High
- Attack requirements
- Present
- Impact type
- —
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA, GitHub and Red Hat.
Summary
Traefik is an HTTP reverse proxy and load balancer. In versions 2.11.27 and below, 3.0.0 through 3.4.4 and 3.5.0-rc1, a path traversal vulnerability was discovered in WASM Traefik’s plugin installation mechanism. By supplying a maliciously crafted ZIP archive containing file paths with ../ sequences, an attacker can overwrite arbitrary files on the system outside of the intended plugin directory. This can lead to remote code execution (RCE), privilege escalation, persistence, or denial of service. This is fixed in versions 2.11.28, 3.4.5 and 3.5.0.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.01363 71st percentileScored 2026-11-08
Fix Fixed traefik (traefik): 3.5.0-rc2github.com/traefik/traefik/v2 (Go): 2.11.28+1 more productRed Hat: 1 advisory
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| traefik | traefik | <= 2.11.27, < 2.11.28; <= 3.0.0, < 3.4.5; 3.5.0-rc1 to before 3.5.0-rc2 | 3.5.0-rc2 | Patch available | CNA |
| — | github.com/traefik/traefik/v2 (Go) | before 2.11.28 | 2.11.28 | Patch available | GHSA-q6gg-9f92-r9wg |
| — | github.com/traefik/traefik/v3 (Go) | before 3.4.5 | 3.4.5 | Patch available | GHSA-q6gg-9f92-r9wg |
| — | github.com/traefik/traefik/v3 (Go) | 3.5.0-rc1 to before 3.5.0 | 3.5.0 | Patch available | GHSA-q6gg-9f92-r9wg |
- traefik Vendortraefik Affected <= 2.11.27, < 2.11.28; <= 3.0.0, < 3.4.5; 3.5.0-rc1 to before 3.5.0-rc2 Fixed in 3.5.0-rc2 Patch available CNA
- github.com/traefik/traefik/v2 (Go) Vendor— Affected before 2.11.28 Fixed in 2.11.28 Patch available GHSA-q6gg-9f92-r9wg
- github.com/traefik/traefik/v3 (Go) Vendor— Affected before 3.4.5 Fixed in 3.4.5 Patch available GHSA-q6gg-9f92-r9wg
- github.com/traefik/traefik/v3 (Go) Vendor— Affected 3.5.0-rc1 to before 3.5.0 Fixed in 3.5.0 Patch available GHSA-q6gg-9f92-r9wg
CPE configurations NVD · 4
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:traefik:traefik:*:*:*:*:*:*:*:* | before 2.11.7; 3.0.0 to before 3.4.4 | Vulnerable | traefik |
| cpe:2.3:a:traefik:traefik:3.5.0:-:*:*:*:*:*:* | 3.5.0 | Vulnerable | traefik |
| cpe:2.3:a:traefik:traefik:3.5.0:rc1:*:*:*:*:*:* | 3.5.0 rc1 | Vulnerable | traefik |
| cpe:2.3:a:traefik:traefik:3.5.0:rc2:*:*:*:*:*:* | 3.5.0 rc2 | Vulnerable | traefik |
- cpe:2.3:a:traefik:traefik:*:*:*:*:*:*:*:* Versions before 2.11.7; 3.0.0 to before 3.4.4 Vulnerable ·traefik
- cpe:2.3:a:traefik:traefik:3.5.0:-:*:*:*:*:*:* Versions 3.5.0 Vulnerable ·traefik
- cpe:2.3:a:traefik:traefik:3.5.0:rc1:*:*:*:*:*:* Versions 3.5.0 rc1 Vulnerable ·traefik
- cpe:2.3:a:traefik:traefik:3.5.0:rc2:*:*:*:*:*:* Versions 3.5.0 rc2 Vulnerable ·traefik
Remediation
- Fix · CNA traefik (traefik) Fixed in 3.5.0-rc2
- Fix · GHSA-q6gg-9f92-r9wg github.com/traefik/traefik/v2 (Go) Fixed in 2.11.28 Advisory →
- Fix · GHSA-q6gg-9f92-r9wg github.com/traefik/traefik/v3 (Go) Fixed in 3.4.5 Advisory →
- Fix · GHSA-q6gg-9f92-r9wg github.com/traefik/traefik/v3 (Go) Fixed in 3.5.0 Advisory →
Red Hat 1 advisory
- RHSA-2026:6192 Released 2026-03-30 · Red Hat rating ImportantRed Hat OpenShift Dev Spaces 3.27.0 Release.
- Red Hat OpenShift Dev Spaces 3.27 registry.redhat.io/devspaces/code-rhel9, registry.redhat.io/devspaces/configbump-rhel9, registry.redhat.io/devspaces/dashboard-rhel9 +9
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat OpenShift Dev Spaces 3.27 | Fixed | RHSA-2026:6192 |
Not affected: 1 product
- Red Hat OpenShift Dev Spaces 3.27
Timeline
- 2026-10-02 Threatist record created from CVE-2025-54386
- 2026-10-03 Alias added: GHSA-q6gg-9f92-r9wg
References
Patch 4
Advisory 2
More Traefik vulnerabilities
- TI-2023-23979 The HTTP/2 protocol allows a denial of service (server resource consumption) because… KEVCVSS 3.1HIGH 7.5
- TI-2023-25774 Uncontrolled Resource Consumption in Traefik CVSS 3.1HIGH 7.5
- TI-2025-40914 Traefik doesn't Prevent Path Normalization Bypass in Router + Middleware Rules CVSS 4.0MEDIUM 6.9
- TI-2022-07529 Authorization header displayed in the debug logs CVSS 3.1MEDIUM 6.5
- TI-2024-30459 HTTP client can remove the X-Forwarded headers in Traefik CVSS 3.1CRITICAL 9.8
- TI-2026-60261 Traefik v3.7.0 Authentication Bypass via from-to-www-redirect CVSS 4.0CRITICAL 9.3
Sources
- CVE-2025-54386 · CVE Program
- CVE-2025-54386 · NVD
- FIRST EPSS
- GHSA-q6gg-9f92-r9wg · GitHub Advisory Database · CC BY 4.0
- CVE-2025-54386 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences