Vulnerability-Lookup

CVE-2025-54386 (GCVE-0-2025-54386)

Vulnerability from cvelistv5 – Published: 2025-08-01 23:32 – Updated: 2025-08-04 15:28

Title

Traefik's Client Plugin is Vulnerable to Path Traversal, Arbitrary File Overwrites and Remote Code Execution

Summary

Traefik is an HTTP reverse proxy and load balancer. In versions 2.11.27 and below, 3.0.0 through 3.4.4 and 3.5.0-rc1, a path traversal vulnerability was discovered in WASM Traefik’s plugin installation mechanism. By supplying a maliciously crafted ZIP archive containing file paths with ../ sequences, an attacker can overwrite arbitrary files on the system outside of the intended plugin directory. This can lead to remote code execution (RCE), privilege escalation, persistence, or denial of service. This is fixed in versions 2.11.28, 3.4.5 and 3.5.0.

Severity

7.3 (High)


                        
                          CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:P/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2025-08-04 15:27 UTC

CWE

CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CWE-30 - Path Traversal: 'dir..filename'

Assigner

GitHub_M CNA under the mitre root

CNA scorecard C 72/100 over 7639 records in the last 180 days details

References

6 references

URL	Tags
https://github.com/traefik/traefik/security/advis…	x_refsource_CONFIRM
https://github.com/traefik/plugin-service/pull/71	x_refsource_MISC
https://github.com/traefik/plugin-service/pull/72	x_refsource_MISC
https://github.com/traefik/traefik/pull/11911	x_refsource_MISC
https://github.com/traefik/traefik/commit/5ef853a…	x_refsource_MISC
https://github.com/traefik/traefik/releases/tag/v…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version	CPE status
traefik	traefik	Affected: <= 2.11.27, < 2.11.28 Affected: <= 3.0.0, < 3.4.5 Affected: >= 3.5.0-rc1, < 3.5.0-rc2	guessed

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-54386",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-08-04T15:27:58.318834Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-08-04T15:28:06.189Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "traefik",
          "vendor": "traefik",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c= 2.11.27, \u003c 2.11.28"
            },
            {
              "status": "affected",
              "version": "\u003c= 3.0.0, \u003c 3.4.5"
            },
            {
              "status": "affected",
              "version": "\u003e= 3.5.0-rc1, \u003c 3.5.0-rc2"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Traefik is an HTTP reverse proxy and load balancer. In versions 2.11.27 and below, 3.0.0 through 3.4.4 and 3.5.0-rc1, a path traversal vulnerability was discovered in WASM Traefik\u2019s plugin installation mechanism. By supplying a maliciously crafted ZIP archive containing file paths with ../ sequences, an attacker can overwrite arbitrary files on the system outside of the intended plugin directory. This can lead to remote code execution (RCE), privilege escalation, persistence, or denial of service. This is fixed in versions 2.11.28, 3.4.5 and 3.5.0."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "HIGH",
            "attackRequirements": "PRESENT",
            "attackVector": "NETWORK",
            "baseScore": 7.3,
            "baseSeverity": "HIGH",
            "privilegesRequired": "HIGH",
            "subAvailabilityImpact": "LOW",
            "subConfidentialityImpact": "LOW",
            "subIntegrityImpact": "LOW",
            "userInteraction": "PASSIVE",
            "vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:P/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-22",
              "description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-30",
              "description": "CWE-30: Path Traversal: \u0027dir..filename\u0027",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-08-01T23:32:21.747Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/traefik/traefik/security/advisories/GHSA-q6gg-9f92-r9wg",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/traefik/traefik/security/advisories/GHSA-q6gg-9f92-r9wg"
        },
        {
          "name": "https://github.com/traefik/plugin-service/pull/71",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/traefik/plugin-service/pull/71"
        },
        {
          "name": "https://github.com/traefik/plugin-service/pull/72",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/traefik/plugin-service/pull/72"
        },
        {
          "name": "https://github.com/traefik/traefik/pull/11911",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/traefik/traefik/pull/11911"
        },
        {
          "name": "https://github.com/traefik/traefik/commit/5ef853a0c53068f69a6c229a5815a0dc6e0a8800",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/traefik/traefik/commit/5ef853a0c53068f69a6c229a5815a0dc6e0a8800"
        },
        {
          "name": "https://github.com/traefik/traefik/releases/tag/v2.11.28",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/traefik/traefik/releases/tag/v2.11.28"
        }
      ],
      "source": {
        "advisory": "GHSA-q6gg-9f92-r9wg",
        "discovery": "UNKNOWN"
      },
      "title": "Traefik\u0027s Client Plugin is Vulnerable to Path Traversal, Arbitrary File Overwrites and Remote Code Execution"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2025-54386",
    "datePublished": "2025-08-01T23:32:21.747Z",
    "dateReserved": "2025-07-21T16:12:20.734Z",
    "dateUpdated": "2025-08-04T15:28:06.189Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2025-54386",
      "date": "2026-10-20",
      "epss": "0.01113",
      "percentile": "0.65522"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "product": "traefik",
                "vendor": "traefik",
                "versions": [
                  {
                    "status": "affected",
                    "version": "\u003c= 2.11.27, \u003c 2.11.28"
                  },
                  {
                    "status": "affected",
                    "version": "\u003c= 3.0.0, \u003c 3.4.5"
                  },
                  {
                    "status": "affected",
                    "version": "\u003e= 3.5.0-rc1, \u003c 3.5.0-rc2"
                  }
                ]
              }
            ],
            "source": "security-advisories@github.com"
          }
        ],
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:a:traefik:traefik:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "70562832-82A7-4B99-AC35-225226910C29",
                    "versionEndExcluding": "2.11.7",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:traefik:traefik:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "7F246C7C-0040-4BAF-B0EF-B2CA593F6369",
                    "versionEndExcluding": "3.4.4",
                    "versionStartIncluding": "3.0.0",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:traefik:traefik:3.5.0:-:*:*:*:*:*:*",
                    "matchCriteriaId": "864A70A5-50E4-4A91-B497-39F0B3859203",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:traefik:traefik:3.5.0:rc1:*:*:*:*:*:*",
                    "matchCriteriaId": "889325B6-8E4F-4F67-AD9C-02413389825F",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:traefik:traefik:3.5.0:rc2:*:*:*:*:*:*",
                    "matchCriteriaId": "99074CB0-FD1A-4092-B627-06CBD23A9ABA",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "Traefik is an HTTP reverse proxy and load balancer. In versions 2.11.27 and below, 3.0.0 through 3.4.4 and 3.5.0-rc1, a path traversal vulnerability was discovered in WASM Traefik\u2019s plugin installation mechanism. By supplying a maliciously crafted ZIP archive containing file paths with ../ sequences, an attacker can overwrite arbitrary files on the system outside of the intended plugin directory. This can lead to remote code execution (RCE), privilege escalation, persistence, or denial of service. This is fixed in versions 2.11.28, 3.4.5 and 3.5.0."
          },
          {
            "lang": "es",
            "value": "Traefik es un proxy inverso HTTP y balanceador de carga. En las versiones 2.11.27 y anteriores, 3.0.0 a 3.4.4 y 3.5.0-rc1, se descubri\u00f3 una vulnerabilidad de Path traversal en el mecanismo de instalaci\u00f3n del complemento de WASM Traefik. Al proporcionar un archivo ZIP manipulado con fines malintencionados que contiene rutas de archivos con secuencias ../, un atacante puede sobrescribir archivos arbitrarios en el sistema fuera del directorio del complemento. Esto puede provocar ejecuci\u00f3n remota de c\u00f3digo (RCE), escalada de privilegios, persistencia o denegaci\u00f3n de servicio. Esto se ha corregido en las versiones 2.11.28, 3.4.5 y 3.5.0."
          }
        ],
        "id": "CVE-2025-54386",
        "lastModified": "2026-06-17T09:39:59.547",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "HIGH",
                "baseScore": 9.8,
                "baseSeverity": "CRITICAL",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 3.9,
              "impactScore": 5.9,
              "source": "nvd@nist.gov",
              "type": "Primary"
            }
          ],
          "cvssMetricV40": [
            {
              "cvssData": {
                "Automatable": "NOT_DEFINED",
                "Recovery": "NOT_DEFINED",
                "Safety": "NOT_DEFINED",
                "attackComplexity": "HIGH",
                "attackRequirements": "PRESENT",
                "attackVector": "NETWORK",
                "availabilityRequirement": "NOT_DEFINED",
                "baseScore": 7.3,
                "baseSeverity": "HIGH",
                "confidentialityRequirement": "NOT_DEFINED",
                "exploitMaturity": "NOT_DEFINED",
                "integrityRequirement": "NOT_DEFINED",
                "modifiedAttackComplexity": "NOT_DEFINED",
                "modifiedAttackRequirements": "NOT_DEFINED",
                "modifiedAttackVector": "NOT_DEFINED",
                "modifiedPrivilegesRequired": "NOT_DEFINED",
                "modifiedSubAvailabilityImpact": "NOT_DEFINED",
                "modifiedSubConfidentialityImpact": "NOT_DEFINED",
                "modifiedSubIntegrityImpact": "NOT_DEFINED",
                "modifiedUserInteraction": "NOT_DEFINED",
                "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
                "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
                "modifiedVulnIntegrityImpact": "NOT_DEFINED",
                "privilegesRequired": "HIGH",
                "providerUrgency": "NOT_DEFINED",
                "subAvailabilityImpact": "LOW",
                "subConfidentialityImpact": "LOW",
                "subIntegrityImpact": "LOW",
                "userInteraction": "PASSIVE",
                "valueDensity": "NOT_DEFINED",
                "vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:P/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
                "version": "4.0",
                "vulnAvailabilityImpact": "HIGH",
                "vulnConfidentialityImpact": "HIGH",
                "vulnIntegrityImpact": "HIGH",
                "vulnerabilityResponseEffort": "NOT_DEFINED"
              },
              "source": "security-advisories@github.com",
              "type": "Secondary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2025-54386",
                "options": [
                  {
                    "exploitation": "none"
                  },
                  {
                    "automatable": "no"
                  },
                  {
                    "technicalImpact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-08-04T15:27:58.318834Z",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2025-08-02T00:15:25.500",
        "references": [
          {
            "source": "security-advisories@github.com",
            "tags": [
              "Patch"
            ],
            "url": "https://github.com/traefik/plugin-service/pull/71"
          },
          {
            "source": "security-advisories@github.com",
            "tags": [
              "Patch"
            ],
            "url": "https://github.com/traefik/plugin-service/pull/72"
          },
          {
            "source": "security-advisories@github.com",
            "tags": [
              "Patch"
            ],
            "url": "https://github.com/traefik/traefik/commit/5ef853a0c53068f69a6c229a5815a0dc6e0a8800"
          },
          {
            "source": "security-advisories@github.com",
            "tags": [
              "Patch"
            ],
            "url": "https://github.com/traefik/traefik/pull/11911"
          },
          {
            "source": "security-advisories@github.com",
            "tags": [
              "Release Notes"
            ],
            "url": "https://github.com/traefik/traefik/releases/tag/v2.11.28"
          },
          {
            "source": "security-advisories@github.com",
            "tags": [
              "Vendor Advisory"
            ],
            "url": "https://github.com/traefik/traefik/security/advisories/GHSA-q6gg-9f92-r9wg"
          }
        ],
        "sourceIdentifier": "security-advisories@github.com",
        "vulnStatus": "Analyzed",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-22"
              },
              {
                "lang": "en",
                "value": "CWE-30"
              }
            ],
            "source": "security-advisories@github.com",
            "type": "Secondary"
          }
        ]
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-06-28T07:05:18+00:00",
      "cve": "CVE-2025-54386",
      "id": "CVE-2025-54386",
      "initial_release_date": "2025-08-01T23:32:21.747000+00:00",
      "product_status:fixed": "4",
      "product_status:known_not_affected": "57",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "traefik: Traefik\u0027s Client Plugin is Vulnerable to Path Traversal, Arbitrary File Overwrites and Remote Code Execution",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-54386.json",
      "version": "3"
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2025-54386",
                    "options": [
                      {
                        "Exploitation": "none"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "total"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2025-08-04T15:27:58.318834Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2025-08-04T15:28:02.818Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "product": "traefik",
              "vendor": "traefik",
              "versions": [
                {
                  "status": "affected",
                  "version": "\u003c= 2.11.27, \u003c 2.11.28"
                },
                {
                  "status": "affected",
                  "version": "\u003c= 3.0.0, \u003c 3.4.5"
                },
                {
                  "status": "affected",
                  "version": "\u003e= 3.5.0-rc1, \u003c 3.5.0-rc2"
                }
              ]
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "Traefik is an HTTP reverse proxy and load balancer. In versions 2.11.27 and below, 3.0.0 through 3.4.4 and 3.5.0-rc1, a path traversal vulnerability was discovered in WASM Traefik\u2019s plugin installation mechanism. By supplying a maliciously crafted ZIP archive containing file paths with ../ sequences, an attacker can overwrite arbitrary files on the system outside of the intended plugin directory. This can lead to remote code execution (RCE), privilege escalation, persistence, or denial of service. This is fixed in versions 2.11.28, 3.4.5 and 3.5.0."
            }
          ],
          "metrics": [
            {
              "cvssV4_0": {
                "attackComplexity": "HIGH",
                "attackRequirements": "PRESENT",
                "attackVector": "NETWORK",
                "baseScore": 7.3,
                "baseSeverity": "HIGH",
                "privilegesRequired": "HIGH",
                "subAvailabilityImpact": "LOW",
                "subConfidentialityImpact": "LOW",
                "subIntegrityImpact": "LOW",
                "userInteraction": "PASSIVE",
                "vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:P/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L",
                "version": "4.0",
                "vulnAvailabilityImpact": "HIGH",
                "vulnConfidentialityImpact": "HIGH",
                "vulnIntegrityImpact": "HIGH"
              }
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "cweId": "CWE-22",
                  "description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            },
            {
              "descriptions": [
                {
                  "cweId": "CWE-30",
                  "description": "CWE-30: Path Traversal: \u0027dir..filename\u0027",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2025-08-01T23:32:21.747Z",
            "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
            "shortName": "GitHub_M"
          },
          "references": [
            {
              "name": "https://github.com/traefik/traefik/security/advisories/GHSA-q6gg-9f92-r9wg",
              "tags": [
                "x_refsource_CONFIRM"
              ],
              "url": "https://github.com/traefik/traefik/security/advisories/GHSA-q6gg-9f92-r9wg"
            },
            {
              "name": "https://github.com/traefik/plugin-service/pull/71",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/traefik/plugin-service/pull/71"
            },
            {
              "name": "https://github.com/traefik/plugin-service/pull/72",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/traefik/plugin-service/pull/72"
            },
            {
              "name": "https://github.com/traefik/traefik/pull/11911",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/traefik/traefik/pull/11911"
            },
            {
              "name": "https://github.com/traefik/traefik/commit/5ef853a0c53068f69a6c229a5815a0dc6e0a8800",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/traefik/traefik/commit/5ef853a0c53068f69a6c229a5815a0dc6e0a8800"
            },
            {
              "name": "https://github.com/traefik/traefik/releases/tag/v2.11.28",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/traefik/traefik/releases/tag/v2.11.28"
            }
          ],
          "source": {
            "advisory": "GHSA-q6gg-9f92-r9wg",
            "discovery": "UNKNOWN"
          },
          "title": "Traefik\u0027s Client Plugin is Vulnerable to Path Traversal, Arbitrary File Overwrites and Remote Code Execution"
        }
      },
      "cveMetadata": {
        "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "assignerShortName": "GitHub_M",
        "cveId": "CVE-2025-54386",
        "datePublished": "2025-08-01T23:32:21.747Z",
        "dateReserved": "2025-07-21T16:12:20.734Z",
        "dateUpdated": "2025-08-04T15:28:06.189Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }
  }
}

CERTFR-2025-AVI-0652

Vulnerability from certfr_avis - Published: 2025-08-04 - Updated: 2025-08-04

Une vulnérabilité a été découverte dans dans le greffon "WASM Client" pour Traefik. Elle permet à un attaquant de provoquer une atteinte à l'intégrité des données.

Solutions

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

Impacted products

Vendor	Product	Description
Traefik	Traefik	Greffon "WASM Client" pour Traefik versions v3.5.x antérieures à v3.5.0
Traefik	Traefik	Greffon "WASM Client" pour Traefik versions v3.4.x antérieures à v3.4.5
Traefik	Traefik	Greffon "WASM Client" pour Traefik versions antérieures à v2.11.28

References

Title

Publication Time

FKIE_CVE-2025-54386

Vulnerability from fkie_nvd - Published: 2025-08-02 00:15 - Updated: 2026-06-17 09:39

Severity

9.8 (Critical) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Summary

References

URL	Tags
security-advisories@github.com	https://github.com/traefik/plugin-service/pull/71	Patch
security-advisories@github.com	https://github.com/traefik/plugin-service/pull/72	Patch
security-advisories@github.com	https://github.com/traefik/traefik/commit/5ef853a0c53068f69a6c229a5815a0dc6e0a8800	Patch
security-advisories@github.com	https://github.com/traefik/traefik/pull/11911	Patch
security-advisories@github.com	https://github.com/traefik/traefik/releases/tag/v2.11.28	Release Notes
security-advisories@github.com	https://github.com/traefik/traefik/security/advisories/GHSA-q6gg-9f92-r9wg	Vendor Advisory

Impacted products

Vendor	Product	Version
traefik	traefik	*
traefik	traefik	*
traefik	traefik	3.5.0
traefik	traefik	3.5.0
traefik	traefik	3.5.0

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "traefik",
          "vendor": "traefik",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c= 2.11.27, \u003c 2.11.28"
            },
            {
              "status": "affected",
              "version": "\u003c= 3.0.0, \u003c 3.4.5"
            },
            {
              "status": "affected",
              "version": "\u003e= 3.5.0-rc1, \u003c 3.5.0-rc2"
            }
          ]
        }
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:traefik:traefik:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "70562832-82A7-4B99-AC35-225226910C29",
              "versionEndExcluding": "2.11.7",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:traefik:traefik:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "7F246C7C-0040-4BAF-B0EF-B2CA593F6369",
              "versionEndExcluding": "3.4.4",
              "versionStartIncluding": "3.0.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:traefik:traefik:3.5.0:-:*:*:*:*:*:*",
              "matchCriteriaId": "864A70A5-50E4-4A91-B497-39F0B3859203",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:traefik:traefik:3.5.0:rc1:*:*:*:*:*:*",
              "matchCriteriaId": "889325B6-8E4F-4F67-AD9C-02413389825F",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:traefik:traefik:3.5.0:rc2:*:*:*:*:*:*",
              "matchCriteriaId": "99074CB0-FD1A-4092-B627-06CBD23A9ABA",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Traefik is an HTTP reverse proxy and load balancer. In versions 2.11.27 and below, 3.0.0 through 3.4.4 and 3.5.0-rc1, a path traversal vulnerability was discovered in WASM Traefik\u2019s plugin installation mechanism. By supplying a maliciously crafted ZIP archive containing file paths with ../ sequences, an attacker can overwrite arbitrary files on the system outside of the intended plugin directory. This can lead to remote code execution (RCE), privilege escalation, persistence, or denial of service. This is fixed in versions 2.11.28, 3.4.5 and 3.5.0."
    },
    {
      "lang": "es",
      "value": "Traefik es un proxy inverso HTTP y balanceador de carga. En las versiones 2.11.27 y anteriores, 3.0.0 a 3.4.4 y 3.5.0-rc1, se descubri\u00f3 una vulnerabilidad de Path traversal en el mecanismo de instalaci\u00f3n del complemento de WASM Traefik. Al proporcionar un archivo ZIP manipulado con fines malintencionados que contiene rutas de archivos con secuencias ../, un atacante puede sobrescribir archivos arbitrarios en el sistema fuera del directorio del complemento. Esto puede provocar ejecuci\u00f3n remota de c\u00f3digo (RCE), escalada de privilegios, persistencia o denegaci\u00f3n de servicio. Esto se ha corregido en las versiones 2.11.28, 3.4.5 y 3.5.0."
    }
  ],
  "id": "CVE-2025-54386",
  "lastModified": "2026-06-17T09:39:59.547",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 9.8,
          "baseSeverity": "CRITICAL",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 5.9,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ],
    "cvssMetricV40": [
      {
        "cvssData": {
          "Automatable": "NOT_DEFINED",
          "Recovery": "NOT_DEFINED",
          "Safety": "NOT_DEFINED",
          "attackComplexity": "HIGH",
          "attackRequirements": "PRESENT",
          "attackVector": "NETWORK",
          "availabilityRequirement": "NOT_DEFINED",
          "baseScore": 7.3,
          "baseSeverity": "HIGH",
          "confidentialityRequirement": "NOT_DEFINED",
          "exploitMaturity": "NOT_DEFINED",
          "integrityRequirement": "NOT_DEFINED",
          "modifiedAttackComplexity": "NOT_DEFINED",
          "modifiedAttackRequirements": "NOT_DEFINED",
          "modifiedAttackVector": "NOT_DEFINED",
          "modifiedPrivilegesRequired": "NOT_DEFINED",
          "modifiedSubAvailabilityImpact": "NOT_DEFINED",
          "modifiedSubConfidentialityImpact": "NOT_DEFINED",
          "modifiedSubIntegrityImpact": "NOT_DEFINED",
          "modifiedUserInteraction": "NOT_DEFINED",
          "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
          "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
          "modifiedVulnIntegrityImpact": "NOT_DEFINED",
          "privilegesRequired": "HIGH",
          "providerUrgency": "NOT_DEFINED",
          "subAvailabilityImpact": "LOW",
          "subConfidentialityImpact": "LOW",
          "subIntegrityImpact": "LOW",
          "userInteraction": "PASSIVE",
          "valueDensity": "NOT_DEFINED",
          "vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:P/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
          "version": "4.0",
          "vulnAvailabilityImpact": "HIGH",
          "vulnConfidentialityImpact": "HIGH",
          "vulnIntegrityImpact": "HIGH",
          "vulnerabilityResponseEffort": "NOT_DEFINED"
        },
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2025-54386",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2025-08-04T15:27:58.318834Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2025-08-02T00:15:25.500",
  "references": [
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Patch"
      ],
      "url": "https://github.com/traefik/plugin-service/pull/71"
    },
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Patch"
      ],
      "url": "https://github.com/traefik/plugin-service/pull/72"
    },
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Patch"
      ],
      "url": "https://github.com/traefik/traefik/commit/5ef853a0c53068f69a6c229a5815a0dc6e0a8800"
    },
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Patch"
      ],
      "url": "https://github.com/traefik/traefik/pull/11911"
    },
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Release Notes"
      ],
      "url": "https://github.com/traefik/traefik/releases/tag/v2.11.28"
    },
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://github.com/traefik/traefik/security/advisories/GHSA-q6gg-9f92-r9wg"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-22"
        },
        {
          "lang": "en",
          "value": "CWE-30"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Secondary"
    }
  ]
}

GHSA-Q6GG-9F92-R9WG

Vulnerability from github – Published: 2025-08-01 18:08 – Updated: 2025-11-27 09:02

Summary

Traefik Client Plugin's Path Traversal Vulnerability Allows Arbitrary File Overwrite and Remote Code Execution

Details

Summary

A path traversal vulnerability was discovered in WASM Traefik’s plugin installation mechanism. By supplying a maliciously crafted ZIP archive containing file paths with ../ sequences, an attacker can overwrite arbitrary files on the system outside of the intended plugin directory. This can lead to remote code execution (RCE), privilege escalation, persistence, or denial of service. ✅ After investigation, it is confirmed that no plugins on the Catalog were affected. There is no known impact.

Details

The vulnerability resides in the WASM plugin extraction logic, specifically in the unzipFile function (/plugins/client.go). The application constructs file paths during ZIP extraction using filepath.Join(destDir, f.Name) without validating or sanitizing f.Name. If the ZIP archive contains entries with ../, the resulting path can escape the intended directory, allowing writes to arbitrary locations on the host filesystem.

Attack Requirements

There are several requirements needed to make this attack possible: - The Traefik server should be deployed with plugins enabled with a WASM plugin (yaegi plugins are not impacted). - The attacker should have write access to a remote plugin asset loaded by the Traefik server - The attacker should craft a malicious version of this plugin

Warning

As clearly stated in the documentation, plugins are experimental in Traefik, and unsafe plugins could damage your infrastructure:

Experimental Features Plugins can change the behavior of Traefik in unforeseen ways. Exercise caution when adding new plugins to production Traefik instances.

Impact

This vulnerability did not affect any plugin from the catalog. There is no known impact. Additionally, the catalog will also prevent any compromised plugin to be available across all Traefik versions. This vulnerability can allow an attacker to perform arbitrary file write outside the intended plugin extraction directory by crafting a malicious ZIP archive that includes ../ (directory traversal) in file paths.

Severity

7.3 (High)


                  
                    CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:P/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 2.11.27"
      },
      "package": {
        "ecosystem": "Go",
        "name": "github.com/traefik/traefik/v2"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.11.28"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 3.4.4"
      },
      "package": {
        "ecosystem": "Go",
        "name": "github.com/traefik/traefik/v3"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "3.4.5"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 3.5.0-rc2"
      },
      "package": {
        "ecosystem": "Go",
        "name": "github.com/traefik/traefik/v3"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "3.5.0-rc1"
            },
            {
              "fixed": "3.5.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2025-54386"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-22",
      "CWE-30"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2025-08-01T18:08:15Z",
    "nvd_published_at": "2025-08-02T00:15:25Z",
    "severity": "HIGH"
  },
  "details": "### Summary\nA path traversal vulnerability was discovered in WASM Traefik\u2019s plugin installation mechanism. By supplying a maliciously crafted ZIP archive containing file paths with `../` sequences, an attacker can overwrite arbitrary files on the system outside of the intended plugin directory. This can lead to remote code execution (RCE), privilege escalation, persistence, or denial of service.\n **\u2705 After investigation, it is confirmed that no plugins on the [Catalog](https://plugins.traefik.io/plugins) were affected. There is no known impact.**\n\n### Details\nThe vulnerability resides in the WASM plugin extraction logic, specifically in the `unzipFile` function (`/plugins/client.go`). The application constructs file paths during ZIP extraction using `filepath.Join(destDir, f.Name)` without validating or sanitizing `f.Name`. If the ZIP archive contains entries with `../`, the resulting path can escape the intended directory, allowing writes to arbitrary locations on the host filesystem.\n\n### Attack Requirements\nThere are several requirements needed to make this attack possible:\n- The Traefik server should be deployed with [plugins enabled](https://doc.traefik.io/traefik/plugins/) with a WASM plugin (yaegi plugins are not impacted).\n- The attacker should have write access to a remote plugin asset loaded by the Traefik server\n- The attacker should craft a malicious version of this plugin\n\n### Warning\nAs clearly stated in the [documentation](https://doc.traefik.io/traefik/plugins/), plugins are experimental in Traefik, and unsafe plugins could damage your infrastructure:\n\n\u003e **Experimental Features**\nPlugins can change the behavior of Traefik in unforeseen ways. Exercise caution when adding new plugins to production Traefik instances.\n\n### Impact\n**This vulnerability did not affect any plugin from the catalog. There is no known impact. \nAdditionally, the catalog will also prevent any compromised plugin to be available across all Traefik versions.**\nThis vulnerability can allow an attacker to perform arbitrary file write outside the intended plugin extraction directory by crafting a malicious ZIP archive that includes `../` (directory traversal) in file paths.",
  "id": "GHSA-q6gg-9f92-r9wg",
  "modified": "2025-11-27T09:02:51Z",
  "published": "2025-08-01T18:08:15Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/traefik/traefik/security/advisories/GHSA-q6gg-9f92-r9wg"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-54386"
    },
    {
      "type": "WEB",
      "url": "https://github.com/traefik/plugin-service/pull/71"
    },
    {
      "type": "WEB",
      "url": "https://github.com/traefik/plugin-service/pull/72"
    },
    {
      "type": "WEB",
      "url": "https://github.com/traefik/traefik/pull/11911"
    },
    {
      "type": "WEB",
      "url": "https://github.com/traefik/traefik/commit/5ef853a0c53068f69a6c229a5815a0dc6e0a8800"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/traefik/traefik"
    },
    {
      "type": "WEB",
      "url": "https://github.com/traefik/traefik/releases/tag/v2.11.28"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:P/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L",
      "type": "CVSS_V4"
    }
  ],
  "summary": "Traefik Client Plugin\u0027s Path Traversal Vulnerability Allows Arbitrary File Overwrite and Remote Code Execution"
}

OPENSUSE-SU-2025:15434-1

Vulnerability from csaf_opensuse - Published: 2025-08-12 00:00 - Updated: 2026-09-20 21:39

Summary

govulncheck-vulndb-0.0.20250811T192933-1.1 on GA media

Severity

Moderate

Scope

29 vulnerabilities in this advisory, including CVE-2025-54386.

CVE-2025-54386

9.8 (Critical)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Recommended: 4 products

Open the full advisory

OPENSUSE-SU-2026:10143-1

Vulnerability from csaf_opensuse - Published: 2026-02-03 00:00 - Updated: 2026-09-17 16:52

Summary

traefik2-2.11.35-1.1 on GA media

Severity

Moderate

Scope

4 vulnerabilities in this advisory, including CVE-2025-54386.

CVE-2025-54386

9.8 (Critical)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Recommended: 4 products

Open the full advisory

RHSA-2026:6192

Vulnerability from csaf_redhat - Published: 2026-03-30 15:41 - Updated: 2026-10-21 04:52

Summary

Red Hat Security Advisory: Red Hat OpenShift Dev Spaces 3.27.0 Release.

Severity

Important

Scope

19 vulnerabilities in this advisory, including CVE-2025-54386.

CVE-2025-54386

A flaw was found in Traefik's plugin installation mechanism. This vulnerability allows remote code execution, privilege escalation, persistence, or application-level denial of service via a crafted ZIP archive exploiting a path traversal vector.

6.4 (Medium)


                
                  CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H

Fixed: 4 products Known not affected: 57 products

https://access.redhat.com/errata/RHSA-2026:6192

Open the full advisory

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

Order JSON

Publication & reservation Sightings KEV catalogs Other timestamps

Loading timeline…

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CVE-2025-54386 (GCVE-0-2025-54386)

CERTFR-2025-AVI-0652

Solutions

FKIE_CVE-2025-54386

GHSA-Q6GG-9F92-R9WG

Summary

Details

Attack Requirements

Warning

Impact

OPENSUSE-SU-2025:15434-1

OPENSUSE-SU-2026:10143-1

RHSA-2026:6192

Tags

Sightings

Nomenclature

Vulnerability timeline

Related by attack behaviour