CVE-2025-54386

Description

Traefik is an HTTP reverse proxy and load balancer. In versions 2.11.27 and below, 3.0.0 through 3.4.4 and 3.5.0-rc1, a path traversal vulnerability was discovered in WASM Traefik’s plugin installation mechanism. By supplying a maliciously crafted ZIP archive containing file paths with ../ sequences, an attacker can overwrite arbitrary files on the system outside of the intended plugin directory. This can lead to remote code execution (RCE), privilege escalation, persistence, or denial of service. This is fixed in versions 2.11.28, 3.4.5 and 3.5.0.

Reserved 2025-07-21 | Published 2025-08-01 | Updated 2025-08-01 | Assigner GitHub_M

Problem types

CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CWE-30: Path Traversal: 'dir..filename'

Product status

<= 2.11.27, < 2.11.28
affected

<= 3.0.0, < 3.4.5
affected

>= 3.5.0-rc1, < 3.5.0-rc2
affected

References

github.com/...raefik/security/advisories/GHSA-q6gg-9f92-r9wg

github.com/traefik/plugin-service/pull/71

github.com/traefik/plugin-service/pull/72

github.com/traefik/traefik/pull/11911

github.com/...ommit/5ef853a0c53068f69a6c229a5815a0dc6e0a8800

github.com/traefik/traefik/releases/tag/v2.11.28

cve.org (CVE-2025-54386)

nvd.nist.gov (CVE-2025-54386)

Download JSON