8.8

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2025-32431

CVE-2025-32431: Traefik has a possible vulnerability with the path matchers

Impact

There is a potential vulnerability in Traefik managing the requests using a PathPrefix, Path or PathRegex matcher.

When Traefik is configured to route the requests to a backend using a matcher based on the path, if the URL contains a /../ in its path, it’s possible to target a backend, exposed using another router, by-passing the middlewares chain.

Example

apiVersion: traefik.io/v1alpha1
kind: IngressRoute
metadata:
  name: my-service
spec:
  routes:
    - match: PathPrefix(‘/service’)
      kind: Rule
      services:
        - name: service-a
          port: 8080
      middlewares:
        - name: my-middleware-a
    - match: PathPrefix(‘/service/sub-path’)
      kind: Rule
      services:
        - name: service-a
          port: 8080

In such a case, the request http://mydomain.example.com/service/sub-path/../other-path will reach the backend my-service-a without operating the middleware my-middleware-a unless the computed path is http://mydomain.example.com/service/other-path and should be computes by the first router (operating my-middleware-a).

Patches

https://github.com/traefik/traefik/releases/tag/v2.11.24
https://github.com/traefik/traefik/releases/tag/v3.3.6
https://github.com/traefik/traefik/releases/tag/v3.4.0-rc2

Workaround

Add a PathRegexp rule to the matcher to prevent matching a route with a /../ in the path.

Example:

match: PathPrefix(`/service`) && !PathRegexp(`(?:(/\.\./)+.*)`)

For more information

If you have any questions or comments about this advisory, please open an issue.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2025-32431

CVE-2025-32431:

8.8

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
github.com/traefik/traefik	go	<= 1.7.34
github.com/traefik/traefik/v2	go	< 2.11.23	2.11.23
github.com/traefik/traefik/v3	go	< 3.3.6	3.3.6
github.com/traefik/traefik/v3	go	= 3.4.0-rc1	3.4.0-rc2

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability described is a path traversal issue where ../ sequences in a URL path can lead to middleware bypass. The analysis focused on the provided pull request (https://github.com/traefik/traefik/pull/11684) which implements the fix.

The commits within this pull request consistently show modifications to the pkg/server/server_entrypoint_tcp.go file, specifically within the createHTTPServer function. This function is responsible for setting up the HTTP request handling pipeline.

The core of the fix is the introduction of a new request handler middleware (named cleanPath, cleanDotDotSegments, and finally sanitizePath through various refactoring stages in the commits) that sanitizes the request URL's path. This new sanitization handler is explicitly added into the chain of handlers constructed by createHTTPServer.

For example, commit 77703bb1b7a14362ebb3af8d681e4630bf453251 introduces handler = cleanPath(handler) within createHTTPServer. Subsequent commits refine this sanitization logic and its invocation but the central idea remains: sanitization is added where it was previously missing.

The vulnerability, therefore, existed in createHTTPServer by omission – it failed to ensure that request paths were sanitized before being used by downstream components like routing matchers (PathPrefix, Path, PathRegex as mentioned in the advisory). These matchers would have processed the unsanitized, potentially malicious, path.

The functions performing the sanitization (e.g., sanitizePath) are part of the mitigation, not the vulnerable functions themselves. While the routing matchers process the malicious input, the patch addresses the vulnerability by modifying createHTTPServer to clean the input before it reaches these matchers. Thus, server.createHTTPServer is identified as the vulnerable function because it was the point in the code where the necessary sanitization was missing, and its modification was key to patching the vulnerability.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.

8.8

-

Basic Information

Basic Information

Concerned about an active attack path?

CVE-2025-32431: Traefik has a possible vulnerability with the path matchers

Impact

Example

Patches

Workaround

For more information

CVE-2025-32431:

8.8

-

Basic Information

Basic Information

Is this CVE running in your environment?

Technical Details

Technical Details

Vulnerability IntelligenceMiggo AI

Root Cause Analysis

Vulnerable functions

Vulnerability IntelligenceMiggo AI

Unlock WAF rules for this CVE

WAF Protection Rules

WAF Rule

Reasoning

Basic Information

Basic Information

8.8

8.8

Technical Details

Vulnerability IntelligenceMiggo AI

Root Cause Analysis

Vulnerable functions

CVE-2025-32431: Traefik has a possible vulnerability with the path matchers

Impact

Example

Patches

Workaround

For more information

Vulnerability Intelligence
Miggo AI

Vulnerability Intelligence
Miggo AI

Vulnerability Intelligence
Miggo AI