CVE-2025-32431 is a critical (CVSS 9.1) flaw in Traefik path matchers. A request containing a dot dot segment can reach a backend exposed by another router and skip its middleware chain. Upgrade to 2.11.24, 3.3.6 or 3.4.0-rc2, or use the PathRegexp workaround.
What's affected
The NVD record says versions before 2.11.24, 3.3.6 and 3.4.0-rc2 are affected, and that the problem sits in how Traefik handles requests that use a PathPrefix, Path or PathRegex matcher. When a URL contains /../, it can target a backend exposed by another router, bypassing the middleware chain of the router that should have matched.
One detail to watch: the GitHub advisory GHSA-6p68-w45g-48j7 lists patched versions as v2.11.23, v3.3.6 and v3.4.0-rc2, while the NVD text names 2.11.24 for the 2.11 line. Traefik also published a v2.11.24 release. Running 2.11.24 or later satisfies both statements.
The weakness class is CWE-22 (path traversal). The CVSS 3.1 vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N. The advisory itself labels severity as High, while NVD scores it 9.1, Critical. The KEV flag is false and the advisory reports no attacks.
How to check if you're exposed
Find the Traefik version in every cluster and host.
traefik version
docker ps | grep -i traefik
kubectl get deploy,ds -A -o wide | grep -i traefik
Compare each result with the fixed versions above. Then look at your routing. The risk matters where two routers overlap by path, with one router adding authentication, rate limits or other middleware and another router covering a sub path without them. The advisory's example has a router for /service with a middleware and a second router for /service/sub-path without it.
If every route has the same middleware, the bypass gains less, but upgrading is still the right step.
What to do now
- Upgrade Traefik to 2.11.24, 3.3.6, 3.4.0-rc2 or later, and verify the running version afterwards.
- If you cannot upgrade today, use the workaround in the advisory: add a
PathRegexprule to the matcher so that a route cannot match a path containing/../. - List routers that overlap by path prefix, and make sure security middleware, such as authentication, applies to every router that can reach a protected backend.
- Add authentication at the backend as well, so that skipping the proxy layer does not skip the control.
- Review proxy access logs for request paths containing
/../or its encoded forms.
The free in-browser dependency scan takes a manifest or lockfile and lists known CVEs for the packages in it, and the Gold directory lets you look up a CVE by id.
Why it matters
Middleware is where many teams put their access control: login checks, IP rules, rate limits. That only works if the router decision is made on the same path the backend will see. Here the router matched on the raw text, while the final path was different once dot dot segments were resolved, so a request could take a different route than the one the policy was written for.
The takeaway is to normalise before you match, and to avoid making the proxy the only place a rule exists. Defence at the backend costs little and covers this whole class of mistake.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Which Traefik versions fix it?
Per the NVD record, 2.11.24, 3.3.6 and 3.4.0-rc2. The advisory lists 2.11.23 for the 2.11 line, so use 2.11.24 or later.
Is there a workaround?
Yes. The advisory says to add a PathRegexp rule that stops a route matching a path containing a slash dot dot slash segment.
Sources
- Gold entry for CVE-2025-32431
- GitHub advisory GHSA-6p68-w45g-48j7
- Traefik v2.11.24 release
- Traefik v3.3.6 release
Last reviewed: 19 October 2026.
