- Description
- Traefik (pronounced traffic) is an HTTP reverse proxy and load balancer. In versions prior to 2.11.24, 3.3.6, and 3.4.0-rc2. There is a potential vulnerability in Traefik managing the requests using a PathPrefix, Path or PathRegex matcher. When Traefik is configured to route the requests to a backend using a matcher based on the path, if the URL contains a /../ in its path, it’s possible to target a backend, exposed using another router, by-passing the middlewares chain. This issue has been patched in versions 2.11.24, 3.3.6, and 3.4.0-rc2. A workaround involves adding a `PathRegexp` rule to the matcher to prevent matching a route with a `/../` in the path.
- Source
- security-advisories@github.com
- NVD status
- Awaiting Analysis
CVSS 4.0
- Type
- Secondary
- Base score
- 8.8
- Impact score
- -
- Exploitability score
- -
- Vector string
- CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
- Severity
- HIGH
- security-advisories@github.com
- CWE-22
- Hype score
- Not currently trending
🚨 CVE-2025-32431 🔴 HIGH (8.8) 🏢 traefik - traefik 🏗️ < 2.11.24 🔗 https://t.co/SANFuvJJNU 🔗 https://t.co/wLuWD2ogFv 🔗 https://t.co/lQFoHT3o2F 🔗 https://t.co/hJW66WIlV1 🔗 https://t.co/gZXIBHcrxC #CyberCron #VulnAlert #InfoSec https://t.co/xq7V2NjXK2
@cybercronai
22 Apr 2025
16 Impressions
0 Retweets
0 Likes
0 Bookmarks
0 Replies
0 Quotes
[CVE-2025-32431: HIGH] Vulnerability alert: Traefik versions prior to 2.11.24, 3.3.6, and 3.4.0-rc2 may be exposed to attacks exploiting path manipulation. Update to patched versions to secure your system.#cve,CVE-2025-32431,#cybersecurity https://t.co/AfktQ9B9Gl https://t.co/z3e
@CveFindCom
22 Apr 2025
64 Impressions
0 Retweets
0 Likes
0 Bookmarks
0 Replies
0 Quotes
CVE-2025-32431 Traefik (pronounced traffic) is an HTTP reverse proxy and load balancer. In versions prior to 2.11.24, 3.3.6, and 3.4.0-rc2. There is a potential vulnerability in Tra… https://t.co/2VHPW1UGzW
@CVEnew
21 Apr 2025
524 Impressions
2 Retweets
0 Likes
0 Bookmarks
0 Replies
0 Quotes
🔍 Path Matchers Vulnerability – CVE-2025-32431 We’ve addressed a potential vulnerability in Traefik managing the requests using a PathPrefix, Path or PathRegex matcher. Read the full security advisory for details and mitigation steps: https://t.co/0KC4YqAeLl
@traefik
21 Apr 2025
411 Impressions
1 Retweet
5 Likes
1 Bookmark
0 Replies
0 Quotes