CVE-2025-47952 Details
Description
Traefik (pronounced traffic) is an HTTP reverse proxy and load balancer. Prior to versions 2.11.25 and 3.4.1, there is a potential vulnerability in Traefik managing the requests using a PathPrefix, Path or PathRegex matcher. When Traefik is configured to route the requests to a backend using a matcher based on the path, if the URL contains a URL encoded string in its path, it’s possible to target a backend, exposed using another router, by-passing the middlewares chain. This issue has been patched in versions 2.11.25 and 3.4.1.
A vulnerability exists in Traefik versions through 2.11.24 and through 3.4.0, allowing requests with URL-encoded strings to bypass the middleware chain. This issue arises when Traefik uses PathPrefix, Path, or PathRegex matchers to route requests to backends. The vulnerability can be exploited by sending a request that includes a URL-encoded traversal sequence, which can manipulate the request path and evade applied middlewares, potentially leading to unauthorized access or actions on the backend service.
Users can upgrade to Traefik versions 2.11.25 or 3.4.1, both of which include the necessary patch. Instructions for downloading these versions are available on the Traefik GitHub Releases page.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed May 30, 2025References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-22 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| traefik traefik | < 2.11.25 >= 3.0.0, < 3.4.1 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Nov 25, 2025 | Initial Analysis | [email protected] |
| May 30, 2025 | New CVE Received | [email protected] |