CVE-2025-47952: Traefik Path Traversal Vulnerability

CVE-2025-47952 Overview

A path traversal vulnerability exists in Traefik, a popular HTTP reverse proxy and load balancer, that allows attackers to bypass middleware chains through URL-encoded path manipulation. When Traefik is configured to route requests to backends using path-based matchers (PathPrefix, Path, or PathRegex), attackers can craft requests with URL-encoded strings in the path to target backends exposed by different routers, effectively circumventing security middleware.

Critical Impact

Attackers can bypass authentication, authorization, and other security middleware by exploiting URL encoding inconsistencies in path-based routing, potentially gaining unauthorized access to protected backend services.

Affected Products

• Traefik versions prior to 2.11.25
• Traefik versions 3.x prior to 3.4.1

Discovery Timeline

• 2025-05-30 - CVE-2025-47952 published to NVD
• 2025-11-25 - Last updated in NVD database

Technical Details for CVE-2025-47952

Vulnerability Analysis

This vulnerability (CWE-22: Path Traversal) stems from improper handling of URL-encoded characters in request paths during the routing decision process. When Traefik evaluates path-based routing rules, discrepancies between how the router interprets the URL versus how the backend ultimately processes it create a security gap. An attacker can exploit this by including URL-encoded sequences in their request paths that the Traefik router processes differently than the target backend services.

The vulnerability is network-accessible and requires no authentication, though exploitation requires specific conditions to be met (the target must use path-based routing with middleware chains). Successful exploitation results in unauthorized access to protected resources by completely bypassing middleware that would normally enforce security policies like authentication or rate limiting.

Root Cause

The root cause lies in the inconsistent normalization of URL-encoded paths between Traefik's routing logic and the underlying request handling. The gorilla/mux dependency used by Traefik did not properly normalize request paths before making routing decisions, allowing specially crafted URL-encoded strings to be interpreted differently at the routing stage versus when passed to backends.

Attack Vector

The attack is conducted over the network by sending HTTP requests with carefully crafted URL-encoded path segments. When Traefik is configured with multiple routers using path-based matchers, an attacker can construct a request that appears to match one router's path pattern (with its associated middleware) but actually gets routed to a different backend after URL decoding occurs. This allows bypassing of middleware chains such as authentication handlers, authorization policies, rate limiters, or security headers middleware.

// Patch to go.mod - Update mux dependency for path normalization fix
 // Containous forks
 replace (
 	github.com/abbot/go-http-auth => github.com/containous/go-http-auth v0.4.1-0.20200324110947-a37a7636d23e
-	github.com/gorilla/mux => github.com/containous/mux v0.0.0-20220627093034-b2dd784e613f
+	github.com/gorilla/mux => github.com/containous/mux v0.0.0-20250523120546-41b6ec3aed59
 	github.com/mailgun/minheap => github.com/containous/minheap v0.0.0-20190809180810-6e71eb837595
 )

Source: GitHub Commit

Detection Methods for CVE-2025-47952

Indicators of Compromise

• HTTP requests containing unusual URL-encoded sequences in paths (e.g., %2e%2e, %2f, double-encoding patterns)
• Access logs showing requests reaching backends that should be protected by middleware
• Requests to protected endpoints without corresponding authentication middleware processing in access logs
• Unusual patterns of path-based routing bypasses visible in Traefik debug logs

Detection Strategies

• Monitor Traefik access logs for requests containing URL-encoded path segments that differ when decoded
• Implement Web Application Firewall (WAF) rules to detect and alert on path traversal patterns
• Enable Traefik debug logging temporarily to compare routing decisions against actual backend requests
• Deploy intrusion detection rules for HTTP requests with double URL encoding or abnormal path patterns

Monitoring Recommendations

• Enable comprehensive access logging in Traefik with full request path capture
• Set up alerts for requests that reach protected backends without triggering expected middleware
• Monitor for sudden changes in traffic patterns to previously restricted endpoints
• Implement centralized log aggregation to correlate Traefik routing decisions with backend access patterns

How to Mitigate CVE-2025-47952

Immediate Actions Required

• Upgrade Traefik to version 2.11.25 or later for the 2.x branch
• Upgrade Traefik to version 3.4.1 or later for the 3.x branch
• Review all router configurations using PathPrefix, Path, or PathRegex matchers
• Audit middleware chains to ensure critical security middleware cannot be bypassed through alternative routes

Patch Information

The vulnerability has been patched in Traefik versions 2.11.25 and 3.4.1. The fix updates the forked containous/mux dependency to version v0.0.0-20250523120546-41b6ec3aed59, which properly normalizes request paths before routing decisions are made. Organizations should upgrade to these patched versions immediately.

For detailed patch information, refer to the GitHub Security Advisory GHSA-vrch-868g-9jx5 and the official releases for v2.11.25 and v3.4.1.

Workarounds

• Implement additional URL normalization at the network edge (e.g., using an upstream WAF or load balancer) before requests reach Traefik
• Add explicit deny rules for requests containing suspicious URL-encoded sequences in security middleware
• Consider implementing backend-level authentication as a defense-in-depth measure that does not rely solely on Traefik middleware
• Temporarily restrict access to sensitive backends at the network level while planning the upgrade

# Upgrade Traefik using Docker (example for 3.x branch)
docker pull traefik:v3.4.1
docker stop traefik-container
docker rm traefik-container
docker run -d --name traefik-container \
  -p 80:80 -p 443:443 \
  -v /var/run/docker.sock:/var/run/docker.sock:ro \
  -v /path/to/traefik.yml:/etc/traefik/traefik.yml:ro \
  traefik:v3.4.1