#VU109917 Path traversal in Traefik - CVE-2025-47952

Vulnerability identifier: #VU109917

Vulnerability risk: Medium

CVSSv4.0: 1.7 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2025-47952

CWE-ID: CWE-22

Exploitation vector: Network

Exploit availability: No

Vulnerable software:
Traefik
Server applications / Other server solutions

Vendor: Containous

Description

The vulnerability allows a remote attacker to perform directory traversal attacks.

The vulnerability exists due to input validation error when processing directory traversal sequences within the requests using a PathPrefix, Path or PathRegex matcher. A remote attacker can send a specially crafted HTTP request and read arbitrary files on the system.

Mitigation
Install updates from vendor's website.

Vulnerable software versions

Traefik: 2.11.0, 2.11.1, 2.11.2, 2.11.3, 2.11.4, 2.11.5, 2.11.6, 2.11.7, 2.11.8, 2.11.9, 2.11.10, 2.11.11, 2.11.12, 2.11.13, 2.11.14, 2.11.15, 2.11.16, 2.11.17, 2.11.18, 2.11.19, 2.11.20, 2.11.21, 2.11.22, 2.11.23, 2.11.24, 3.0.0, 3.0.0 rc5, 3.0.1, 3.0.2, 3.0.3, 3.0.4, 3.1.0, 3.1.1, 3.1.2, 3.1.3, 3.1.4, 3.1.5, 3.1.6, 3.1.7, 3.2.0, 3.2.1, 3.2.2, 3.2.3, 3.2.4, 3.2.5, 3.3.0, 3.3.1, 3.3.2, 3.3.3, 3.3.4, 3.3.5, 3.3.6, 3.3.7, 3.4.0

---

External links
https://github.com/advisories/GHSA-vrch-868g-9jx5

---

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.