CVE-2025-54386 is a critical (CVSS 9.8) path traversal in how Traefik installs WASM plugins. A crafted ZIP archive can write files outside the plugin directory, which can lead to code execution or denial of service. Fixed in Traefik 2.11.28, 3.4.5 and 3.5.0.
What's affected
- Traefik 2.11.27 and below.
- Traefik 3.0.0 through 3.4.4 and 3.5.0-rc1.
- Fixed in 2.11.28, 3.4.5 and 3.5.0.
The record lists CVSS 9.8 (Critical). It is not on the CISA Known Exploited Vulnerabilities list as of the record.
How to check if you're exposed
Check the version.
traefik version
For containers, check the image tag.
docker image ls traefik
Then see whether your static configuration enables plugins at all. If it does not, the plugin installer is not part of your exposure, though you should still upgrade.
What to do now
- Upgrade to 2.11.28, 3.4.5 or 3.5.0 or later on your branch.
- List the plugins you load and confirm each one comes from a source you trust.
- Run Traefik as a non root user with a read only filesystem where you can.
- Pin plugin versions in configuration and review changes to them.
- Run the free in browser dependency scan to find affected components across your projects, then check the Gold entry for updates.
Work in that order. Inventory first, because you cannot patch what you do not know you run. Fix the internet facing and shared systems before the internal ones, and write down the version you ended up on so the next review starts from facts rather than memory.
Why it matters
The weakness is CWE-22, with CWE-30 also tagged. An archive entry whose path contains parent directory sequences can escape the extraction folder if the extractor does not check the final path. This is often called a zip slip.
The risk sits in the supply chain. If the archive source is compromised or a plugin is malicious, the proxy host is the victim. A reverse proxy holds certificates and routes traffic, so a file overwrite there is serious.
Severity scores are a starting point. The score for this entry is 9.8, and it describes the worst case for the weakness, not your environment. Weigh it against whether the affected component is reachable from outside, who can talk to it, and what it can touch if it is taken over. Reachability analysis helps with that last question for libraries, and the Gold page for this CVE collects the affected versions in one place.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Do I need to be using plugins?
The advisory is about plugin installation, so plugin use is the main path. Upgrade anyway.
Which branch should I move to?
Stay on your branch and take the matching fixed version: 2.11.28, 3.4.5 or 3.5.0.
Sources
- https://github.com/traefik/plugin-service/pull/71
- https://github.com/traefik/plugin-service/pull/72
- https://github.com/traefik/traefik/commit/5ef853a0c53068f69a6c229a5815a0dc6e0a8800
- https://github.com/traefik/traefik/pull/11911
- https://github.com/traefik/traefik/releases/tag/v2.11.28
- https://github.com/traefik/traefik/security/advisories/GHSA-q6gg-9f92-r9wg
Last reviewed: 18 October 2026.
