CVE-2025-54386
HIGH EPSS 59.6%
Published Aug 2, 202511mo ago · Modified Jun 17, 20262w ago
7.3 CVSS 4.0
Published Aug 2, 2025 11mo ago
Last Modified Jun 17, 2026 2w ago
Description
Traefik is an HTTP reverse proxy and load balancer. In versions 2.11.27 and below, 3.0.0 through 3.4.4 and 3.5.0-rc1, a path traversal vulnerability was discovered in WASM Traefik’s plugin installation mechanism. By supplying a maliciously crafted ZIP archive containing file paths with ../ sequences, an attacker can overwrite arbitrary files on the system outside of the intended plugin directory. This can lead to remote code execution (RCE), privilege escalation, persistence, or denial of service. This is fixed in versions 2.11.28, 3.4.5 and 3.5.0.
CVSS Details
Base Score
Exploitability
Impact
Vector string
CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:P/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Attack Vector Network
Attack Complexity High
Privileges Required High
User Interaction P
Scope X
Threat Intelligence
EPSS Exploit Probability
59.6% percentile
Exploit & Patch Status
No Known Exploit
Patch Available
Weaknesses 2
CWE-22 Path Traversal Resource Mgmt
CWE-30
Affected Products 5
References 6
- github.com https://github.com/traefik/plugin-service/pull/71
- github.com https://github.com/traefik/plugin-service/pull/72
- github.com https://github.com/traefik/traefik/commit/5ef853a0c53068f69a6c229a5815a0dc6e0a8800
- github.com https://github.com/traefik/traefik/pull/11911
- github.com https://github.com/traefik/traefik/releases/tag/v2.11.28
- github.com https://github.com/traefik/traefik/security/advisories/GHSA-q6gg-9f92-r9wg
Remediation
- github.com https://github.com/traefik/plugin-service/pull/71
- github.com https://github.com/traefik/plugin-service/pull/72
- github.com https://github.com/traefik/traefik/commit/5ef853a0c53068f69a6c229a5815a0dc6e0a8800
- github.com https://github.com/traefik/traefik/pull/11911