CVE-2025-54386: Traefik's Client Plugin is Vulnerable to Path Traversal, Arbitrary File Overwrites and Remote Code Execution
Vulnerability summary
CVE-2025-54386 is a critical (CVSS 9.8) vulnerability in traefik. EPSS estimates a 1.36% chance of exploitation in the next 30 days, higher than 71.8% of scored vulnerabilities.
Not severe (CVSS 7.3, network access); no exploitation reported by the 5 checked sources
Source freshness unavailable
How is this decided?Advisory lineage
Upstream 0 · Downstream 3 · Related 4Timeline
- 01-08-2025PublishedVulnerability first disclosed.
- 04-08-2025Last modifiedVulnerability information updated.
Description
Traefik is an HTTP reverse proxy and load balancer. In versions 2.11.27 and below, 3.0.0 through 3.4.4 and 3.5.0-rc1, a path traversal vulnerability was discovered in WASM Traefik’s plugin installation mechanism. By supplying a maliciously crafted ZIP archive containing file paths with ../ sequences, an attacker can overwrite arbitrary files on the system outside of the intended plugin directory. This can lead to remote code execution (RCE), privilege escalation, persistence, or denial of service. This is fixed in versions 2.11.28, 3.4.5 and 3.5.0.
CVSS metrics
6 scores · 5 sources · 2 versions- OSV · WolfiEcosystem advisory · calculated7.3HighCVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:P/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L
- OSV · GoEcosystem advisory · calculated7.3HighCVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:P/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L
- OSV · ChainguardEcosystem advisory · calculated7.3HighCVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:P/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L
- NVDNIST7.3HighCVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:P/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
EPSS trend
Probability
1.36%
Chance of exploitation in the next 30 days
Percentile
72%
Versus all other CVEs
30-day change
Increase +0.25 pp
From 1.11% on 04-10-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-22Improper Limitation of a Pathname to a Restricted DirectoryThe product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
- CWE-30Path Traversal: '\dir\..\filename'The product uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize '\dir\..\filename' (leading backslash dot dot) sequences that can resolve to a location that is outside of that directory.
Affected systems
Known conditions: network-reachable, administrative account, user interaction (CVSS vector). Other conditions: not stated in public data.
Chainguard2 products
- traefik-2.11All versions (No fix recorded)
- traefik-3.3All versions (No fix recorded)
Github.com/traefik/traefik2 products
- v2< 2.11.28
- v3< 3.4.5 | ≥ 3.5.0-rc1, < 3.5.0
Github.com/traefik1 product
- traefikAll versions (No fix recorded)
Traefik1 product
- traefikEOL< 2.11.28 | < 3.4.5 | ≥ 3.5.0-rc1, < 3.5.0-rc2 | < 2.11.7 | ≥ 3.0.0, < 3.4.4 | 3.5.0 | 3.5.0:rc1 | 3.5.0:rc2
Wolfi1 product
- traefik-3.3All versions (No fix recorded)
5 vendors · 7 products
References
9 links- github.com/traefik/traefik/security/advisories/GHSA-q6gg-9f92-r9wgX Refsource CONFIRMAdvisoryWEBVendor Advisory
- github.com/traefik/traefik/commit/5ef853a0c53068f69a6c229a5815a0dc6e0a8800X Refsource MISCFIXWEBPatch
- github.com/traefik/traefikPACKAGE