CVE-2025-47952: Critical Path Matcher Bypass in Traefik

CVE-2025-47952 is a critical flaw (CVSS 9.1) in Traefik, the HTTP reverse proxy and load balancer. When routes use a Path, PathPrefix or PathRegex matcher, a URL-encoded path can reach a backend exposed by another router and skip its middleware chain. The fixes are Traefik 2.11.25 and 3.4.1.

What's affected

Per the CVE record and the GitHub advisory, two release lines are affected: Traefik 2.x before 2.11.25, and Traefik 3.x before 3.4.1. The patched versions are 2.11.25 and 3.4.1.

The condition is a configuration where Traefik routes requests to a backend with a matcher based on the path, using Path, PathPrefix or PathRegex. If the request URL contains an encoded string in its path, the request may land on a backend exposed by a different router, and the middlewares attached to the intended router are not applied.

The record files this under CWE-22 (Path Traversal). The base vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N: network reachable, no privileges and no interaction, with high impact on confidentiality and integrity.

How to check if you're exposed

Check the running version of every Traefik instance. On a host or inside a container:

traefik version

In Kubernetes, list the images in use across namespaces:

kubectl get pods -A -o custom-columns=NS:.metadata.namespace,NAME:.metadata.name,IMAGE:.spec.containers[*].image | grep -i traefik

If you installed with Helm, helm list -A shows the chart release, and the chart values show the image tag.

A version below 2.11.25 on the 2.x line, or below 3.4.1 on the 3.x line, is affected. Then look at your routes. The advisory example uses two routes, one on a broader prefix with an authentication middleware and one on a narrower sub-path without it. Any setup where one router carries protective middleware such as authentication, an IP allow list or rate limiting, while another router points to the same or a sibling service, deserves a close read.

What to do now

1. Upgrade Traefik to 2.11.25 or later on the 2.x line, or to 3.4.1 or later on the 3.x line.
2. List every router that uses a Path, PathPrefix or PathRegex matcher together with middlewares, and note which backends are also exposed by a second router.
3. For backends that must never be reached without authentication, add a check at the backend as well, so the proxy is not your only control.
4. Review access logs for requests with encoded characters in the path to protected services, and compare them with your expected traffic.
5. Rebuild any pinned container images and Helm values so the new tag survives the next deploy.
6. Add Traefik to your inventory of components so future advisories map to your clusters quickly. You can also run a free in-browser dependency scan at gold.safeguard.sh/scan to see which of your projects pull in the affected component.

Why it matters

A reverse proxy is often the one place where authentication, rate limits and allow lists are applied. That makes its routing logic part of the security boundary. If the proxy and the backend disagree about what a path means, a request can be matched by the wrong router, and the controls attached to the right one never run.

Path normalization is a long-standing source of this problem. The class here is path traversal, where the way a path is interpreted differs from what the author expected. The lesson is to treat the proxy as one layer, and to give sensitive backends their own authorization check.

It is not listed in the CISA Known Exploited Vulnerabilities catalog, and the record does not report exploitation in the wild. Because the flaw depends on how your routers are configured, an upgrade is the fix, but a configuration review tells you whether you were ever exposed.

Try it yourself

Click through it at your own pace, or open it full screen.

Quick check

Sources

• NVD record for CVE-2025-47952
• Traefik GitHub security advisory GHSA-vrch-868g-9jx5
• Traefik v3.4.1 release (listed in the record)

Last reviewed: 18 October 2026.