CVE-2025-32431CRITICAL 9.1EPSS p50.7%

CVE-2025-32431CVE-2025-32431

Description

Traefik (pronounced traffic) is an HTTP reverse proxy and load balancer. In versions prior to 2.11.24, 3.3.6, and 3.4.0-rc2. There is a potential vulnerability in Traefik managing the requests using a PathPrefix, Path or PathRegex matcher. When Traefik is configured to route the requests to a backend using a matcher based on the path, if the URL contains a /../ in its path, it’s possible to target a backend, exposed using another router, by-passing the middlewares chain. This issue has been patched in versions 2.11.24, 3.3.6, and 3.4.0-rc2. A workaround involves adding a `PathRegexp` rule to the matcher to prevent matching a route with a `/../` in the path.

Scoring

CVSS 3.19.1 (CRITICAL)
VectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
EPSS0.77% probability of exploitation · percentile 50.7% · 2026-06-18T12:00:27Z
Published2025-04-21
Last modified2025-11-25

Underlying weaknesses· 1

CWE-22

References

  1. https://github.com/traefik/traefik/pull/11684
  2. https://github.com/traefik/traefik/releases/tag/v2.11.24
  3. https://github.com/traefik/traefik/releases/tag/v3.3.6
  4. https://github.com/traefik/traefik/releases/tag/v3.4.0-rc2
  5. https://github.com/traefik/traefik/security/advisories/GHSA-6p68-w45g-48j7

1

TypeTargetConfidenceTier
WeaknessImproper Limitation of a Pathname to a Restricted Directory ('Path Traversal')cwe-220%live

Related by meaning· 6

Nearest entities by semantic similarity across the cs-graph corpus.

CVE
CVE-2025-47952
CVE
CVE-2026-40912
CVE
CVE-2025-54386
CVE
CVE-2026-35051
CVE
CVE-2026-44774
CVE
CVE-2026-39858
Sourced from NVD + FIRST.org EPSS. Curated for EU compliance use cases by Adam Lundqvist, Founder at SQUR.