CVE-2025-47952
Critical
Description
Traefik (pronounced traffic) is an HTTP reverse proxy and load balancer. Prior to versions 2.11.25 and 3.4.1, there is a potential vulnerability in Traefik managing the requests using a PathPrefix, Path or PathRegex matcher. When Traefik is configured to route the requests to a backend using a matcher based on the path, if the URL contains a URL encoded string in its path, it’s possible to target a backend, exposed using another router, by-passing the middlewares chain. This issue has been patched in versions 2.11.25 and 3.4.1.
SeverityCritical
CVSS9.1
Exploit probability—
Product
Traefik
PublishedMay 30, 2025
First seenMay 30, 2025
Weakness typeCWE-22Path traversal
How to fix
Update
- traefik traefik2.11.25, 3.4.1 or later
- github.com/traefik/traefik/v33.4.1 or later
- github.com/traefik/traefik/v22.11.25 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| traefik traefik | v < 2.11.25, 3.0.0 ≤ v < 3.4.1 | 2.11.25, 3.4.1 |
| github.com/traefik/traefik/v3Go | v < 3.4.1 | 3.4.1 |
| github.com/traefik/traefik/v2Go | v < 2.11.25 | 2.11.25 |
| github.com/traefik/traefikGo | v ≤ 1.7.34, No range specified | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.