CVE-2025-66490: Traefik Path Traversal Vulnerability

CVE-2025-66490 Overview

CVE-2025-66490 is a path normalization bypass vulnerability in Traefik, a widely deployed HTTP reverse proxy and load balancer. The flaw affects versions prior to 2.11.32 and versions 2.11.31 through 3.6.2. Requests using the PathPrefix, Path, or PathRegex matchers can bypass path normalization when the URL contains encoded restricted characters such as /, \, Null, ;, ?, or #. Attackers can route requests around middleware chains, reaching backends that should be protected by authentication or other security controls. The issue is fixed in versions 2.11.32 and 3.6.3.

Critical Impact
Attackers can send URL-encoded paths to bypass security middleware and reach unintended backend services behind Traefik.

Affected Products

Traefik versions prior to 2.11.32
Traefik versions 2.11.31 through 3.6.2
Deployments using path-based routing with PathPrefix, Path, or PathRegex matchers

Discovery Timeline

2025-12-09 - CVE-2025-66490 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-66490

Vulnerability Analysis

Traefik routes incoming HTTP requests to backend services using matcher rules. When the router uses PathPrefix, Path, or PathRegex matchers, Traefik evaluates the request path to decide which service handles the request and which middleware chain applies. The vulnerability stems from inconsistent path normalization between the matcher evaluation and the request forwarded to the backend.

Requests containing URL-encoded restricted characters, including %2F (/), %5C (\), %00 (Null), %3B (;), %3F (?), and %23 (#), are not normalized before matcher evaluation. This mismatch allows crafted paths to match a route that skips a protective middleware while the backend still interprets the decoded path as the sensitive endpoint. The weakness is classified under CWE-436: Interpretation Conflict.

Root Cause

The root cause is an interpretation conflict between Traefik's routing layer and the downstream service. Traefik matches on the raw encoded path, while backends decode the same characters and treat them as path separators or terminators. Middleware bound to a normalized path such as /admin/ is bypassed when the request arrives as /admin%2F because the matcher does not treat the encoded slash as equivalent.

Attack Vector

Exploitation requires only network access to a Traefik instance using path-based routing. An unauthenticated attacker sends an HTTP request such as GET /admin%2F to a Traefik-fronted domain. The request bypasses middleware attached to the /admin/ prefix, including authentication, authorization, rate limiting, or IP allowlisting, and reaches the backend service. The Traefik security advisory GHSA-gm3x-23wp-hc2c documents the request patterns that trigger the bypass.

Detection Methods for CVE-2025-66490

Indicators of Compromise

HTTP access logs containing URL-encoded restricted characters in request paths, particularly %2F, %5C, %00, %3B, %3F, and %23
Backend service logs showing access to protected routes without preceding authentication or middleware log entries from Traefik
Unexpected 200 responses on paths that should require credentials or additional headers

Detection Strategies

Correlate Traefik router logs with backend application logs to identify requests that reached protected endpoints without matching middleware traversal
Alert on any request path in Traefik access logs containing %2F, %5C, %00, %3B, %3F, or %23 sequences
Compare the running Traefik version against the fixed versions 2.11.32 and 3.6.3 in configuration management inventories

Monitoring Recommendations

Enable Traefik access logging with the full request URI and forward logs to a centralized platform for pattern searches
Track authentication and authorization failure counts per backend, and investigate drops that coincide with encoded-path traffic
Monitor upstream backends for direct-access patterns that historically only occurred after middleware processing

How to Mitigate CVE-2025-66490

Immediate Actions Required

Upgrade Traefik to version 2.11.32 or 3.6.3 (or later, such as 3.6.4) as documented in the Traefik v2.11.32 release notes and Traefik v3.6.4 release notes
Audit path-based routing rules that rely on PathPrefix, Path, or PathRegex matchers to enforce security boundaries
Review backend logs for prior requests containing encoded restricted characters to identify possible exploitation

Patch Information

Traefik addressed CVE-2025-66490 in versions 2.11.32 and 3.6.3. The fix normalizes URL-encoded restricted characters before matcher evaluation so encoded and decoded forms produce the same routing decision. Full details are published in the GitHub Security Advisory GHSA-gm3x-23wp-hc2c.

Workarounds

Add an upstream layer, such as a Web Application Firewall or ingress controller, that rejects or normalizes requests containing %2F, %5C, %00, %3B, %3F, and %23 in the path
Where feasible, apply middleware at the service level as a defense-in-depth control rather than relying solely on Traefik router-attached middleware
Restrict exposure of Traefik-fronted admin paths using network-level allowlists until the upgrade is applied

bash

# Verify installed Traefik version and upgrade
traefik version

# Example Docker upgrade to a fixed release
docker pull traefik:v3.6.4
docker stop traefik && docker rm traefik
docker run -d --name traefik -p 80:80 -p 443:443 traefik:v3.6.4