CVE-2025-54386

HIGH EPSS 59.6%
Published Aug 2, 202511mo ago · Modified Jun 17, 20262w ago
7.3 CVSS 4.0
High
Find Similar
Published Aug 2, 2025 11mo ago
Last Modified Jun 17, 2026 2w ago

Description

Traefik is an HTTP reverse proxy and load balancer. In versions 2.11.27 and below, 3.0.0 through 3.4.4 and 3.5.0-rc1, a path traversal vulnerability was discovered in WASM Traefik’s plugin installation mechanism. By supplying a maliciously crafted ZIP archive containing file paths with ../ sequences, an attacker can overwrite arbitrary files on the system outside of the intended plugin directory. This can lead to remote code execution (RCE), privilege escalation, persistence, or denial of service. This is fixed in versions 2.11.28, 3.4.5 and 3.5.0.

CVSS Details

Base Score
7.3
Exploitability
Impact
Vector string
CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:P/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector Network
Attack Complexity High
Privileges Required High
User Interaction P
Scope X

Threat Intelligence

EPSS Exploit Probability
59.6% percentile
Exploit & Patch Status
No Known Exploit
Patch Available

Weaknesses 2

CWE-22 Path Traversal Resource Mgmt
CWE-30

Affected Products 5

VendorProductVersionRange
traefiktraefik* <2.11.7
traefiktraefik*≥3.0.0  –  <3.4.4
traefiktraefik3.5.0any
traefiktraefik3.5.0any
traefiktraefik3.5.0any

References 6

  • github.com https://github.com/traefik/plugin-service/pull/71
    Patch
  • github.com https://github.com/traefik/plugin-service/pull/72
    Patch
  • github.com https://github.com/traefik/traefik/commit/5ef853a0c53068f69a6c229a5815a0dc6e0a8800
    Patch
  • github.com https://github.com/traefik/traefik/pull/11911
    Patch
  • github.com https://github.com/traefik/traefik/releases/tag/v2.11.28
    Release Notes
  • github.com https://github.com/traefik/traefik/security/advisories/GHSA-q6gg-9f92-r9wg
    Vendor Advisory

Remediation

  • github.com https://github.com/traefik/plugin-service/pull/71
    Patch
  • github.com https://github.com/traefik/plugin-service/pull/72
    Patch
  • github.com https://github.com/traefik/traefik/commit/5ef853a0c53068f69a6c229a5815a0dc6e0a8800
    Patch
  • github.com https://github.com/traefik/traefik/pull/11911
    Patch