CVE-2025-54386

Katalog CVE

CVSS 9.8 · Critical EPSS 1,1%

Kerentanan Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') pada traefik. Skor CVSS 3.1 9.8 (Critical) menurut NVD.

Deskripsi (NVD)

Traefik is an HTTP reverse proxy and load balancer. In versions 2.11.27 and below, 3.0.0 through 3.4.4 and 3.5.0-rc1, a path traversal vulnerability was discovered in WASM Traefik’s plugin installation mechanism. By supplying a maliciously crafted ZIP archive containing file paths with ../ sequences, an attacker can overwrite arbitrary files on the system outside of the intended plugin directory. This can lead to remote code execution (RCE), privilege escalation, persistence, or denial of service. This is fixed in versions 2.11.28, 3.4.5 and 3.5.0.

Rincian

Terbit di NVD

2 Agustus 2025

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

9.8 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CWE-30: Path Traversal: '\dir\..\filename'

EPSS (30 hari)

1,1% peluang dieksploitasi; lebih tinggi dari 65,1% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/traefik/traefik/security/advisories/GHSA-q6gg-9f92-r9wg advisory vendor
• https://github.com/traefik/plugin-service/pull/71 patch
• https://github.com/traefik/plugin-service/pull/72 patch
• https://github.com/traefik/traefik/commit/5ef853a0c53068f69a6c229a5815a0dc6e0a8800 patch
• https://github.com/traefik/traefik/pull/11911 patch
• https://github.com/traefik/traefik/releases/tag/v2.11.28 release notes