CVE-2025-47952

Example

apiVersion: traefik.io/v1alpha1
kind: IngressRoute
metadata:
  name: my-service
spec:
  routes:
    - match: PathPrefix(‘/service’)
      kind: Rule
      services:
        - name: service-a
          port: 8080
      middlewares:
        - name: my-middleware-a
    - match: PathPrefix(‘/service/sub-path’)
      kind: Rule
      services:
        - name: service-a
          port: 8080

In such a case, the request http://mydomain.example.com/service/sub-path/%2e%2e/other-path will reach the backend my-service-a without operating the middleware my-middleware-a unless the computed path is http://mydomain.example.com/service/other-path and should be computes by the first router (operating my-middleware-a).

For more information

If you have any questions or comments about this advisory, please open an issue.

Path traversal with "/../" using URL encodings ("/%2e%2e") allows for circumventing routing rules.

Details

When having defined a route, you can path traverse using the URL encoded variant of /../ and reach endpoints that are not made publicly available. This issue has been found and fixed earlier with regular /../ and has been fixed in this CVE. This URL encoding trick works around that
https://nvd.nist.gov/vuln/detail/CVE-2025-32431

Simply implementing a check on the URL encoding won't be sufficient as path traversal can take numerous formats. See examples here:
https://book.hacktricks.wiki/en/pentesting-web/file-inclusion/index.html

PoC

Setup a service with two endpoints: "/public" and "/private", which returns a 200 OK for both
Setup a Traefik proxy with a single route which points to the service using path /public

Regular requests to traefik /public will return 200 OK and to /private should return 404 (response by Traefik)
When making a request to /public/%2e%2e/private you should receive a 200 OK.

Impact

Impacts all traefik implementations with path prefix routes that expose only part of the downstream api

Suggestion

Provide configuration property which disables all path traversals. Steps:

1. Decode URL
2. Evaluate and construct relative path (do traversal before route evaluation)
3. Compare relative/evaluated path to configured routes (PathPrefix/pathRegexp)

There is a potential vulnerability in Traefik managing the requests using a PathPrefix, Path or PathRegex matcher.

When Traefik is configured to route the requests to a backend using a matcher based on the path, if the URL contains a URL encoded string in its path, it’s possible to target a backend, exposed using another router, by-passing the middlewares chain.

Input manipulates file paths to reach files outside the intended directory, such as configuration or credential files. Typical impact: unauthorized file read or write outside the intended directory.

Kodem intelligence

• https://github.com/traefik/traefik/releases/tag/v2.11.25
• https://github.com/traefik/traefik/releases/tag/v3.4.1

1. What is CVE-2025-47952? CVE-2025-47952 is a low-severity path traversal vulnerability in github.com/traefik/traefik/v3 (go), affecting versions <= 3.4.0. It is fixed in 3.4.1, 2.11.25. Input manipulates file paths to reach files outside the intended directory, such as configuration or credential files.
2. Which packages are affected by CVE-2025-47952?
   • github.com/traefik/traefik/v3 (go) (versions <= 3.4.0)
   • github.com/traefik/traefik (go) (versions <= 1.7.34)
   • github.com/traefik/traefik/v2 (go) (versions < 2.11.25)
3. Is there a fix for CVE-2025-47952? Yes. CVE-2025-47952 is fixed in 3.4.1, 2.11.25. Upgrade to this version or later.
4. Is CVE-2025-47952 exploitable, and should I be worried? Whether CVE-2025-47952 is exploitable in your environment depends on whether the vulnerable code is present and reachable. A CVSS score is a worst-case rating; it does not account for your specific deployment, configuration, or usage patterns. Kodem, an Intelligent Application Security platform, uses runtime intelligence to show which vulnerabilities actually execute in production, so you can focus on the ones that represent real risk. Get a demo
5. What actually determines whether CVE-2025-47952 is exploitable, and how bad it is? Exploitability and impact are not fixed properties of a CVE. They depend on runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A high CVSS score on a dependency that never runs is not the same as real risk. Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter.
6. How do I fix CVE-2025-47952?
   • Upgrade github.com/traefik/traefik/v3 to 3.4.1 or later
   • Upgrade github.com/traefik/traefik/v2 to 2.11.25 or later