6.9

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2025-66490

CVE-2025-66490: Traefik doesn't Prevent Path Normalization Bypass in Router + Middleware Rules

Traefik is an HTTP reverse proxy and load balancer. For versions prior to 2.11.32 and 2.11.31 through 3.6.2, requests using PathPrefix, Path or PathRegex matchers can bypass path normalization. When Traefik uses path-based routing, requests containing URL-encoded restricted characters (/, , Null, ;, ?, #) can bypass the middleware chain and reach unintended backends. For example, a request to http://mydomain.example.com/admin%2F could reach service-a without triggering my-security-middleware, bypassing security controls for the /admin/ path. This issue is fixed in versions 2.11.32 and 3.6.3.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2025-66490

CVE-2025-66490:

6.9

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
github.com/traefik/traefik/v3	go	<= 3.6.2	3.6.3
github.com/traefik/traefik/v2	go	<= 2.11.31	2.11.32

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a path normalization bypass in Traefik, allowing attackers to use URL-encoded characters in the request path to bypass middleware restrictions. For instance, a request to /admin%2f would not match a rule for /admin/, but the backend service would receive a request for /admin/ after the path is decoded, thus bypassing security middleware for the /admin/ route.

The patch addresses this by introducing a new middleware that rejects requests containing certain encoded characters by default. This middleware is added at the entrypoint level, before the routing logic is executed.

The analysis of the patch reveals the following key changes:

A new function denyEncodedCharacters is added in pkg/server/server_entrypoint_tcp.go. This function is a http.Handler middleware that inspects the raw request path for a configurable set of disallowed encoded characters. If a disallowed character is found, it rejects the request with a 400 Bad Request. This function is the core of the fix. Before this patch, no such check was performed.
The createHTTPServer function in the same file is modified to include the denyEncodedCharacters middleware in the handler chain for every HTTP entrypoint, ensuring all incoming requests are checked.
A new configuration struct EncodedCharacters and a corresponding method Map() are added in pkg/config/static/entrypoints.go. The Map() method builds the set of disallowed characters from the configuration, which is then used by the denyEncodedCharacters middleware.

Based on this, the identified functions are relevant for profiling. server.denyEncodedCharacters.func1 directly processes the malicious request path. server.createHTTPServer is responsible for setting up the vulnerable (or patched) request handler chain. static.(*EncodedCharacters).Map is involved in configuring the security fix.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.