CVE-2025-54386

A path traversal vulnerability was discovered in WASM Traefik’s plugin installation mechanism. By supplying a maliciously crafted ZIP archive containing file paths with ../ sequences, an attacker can overwrite arbitrary files on the system outside of the intended plugin directory. This can lead to remote code execution (RCE), privilege escalation, persistence, or denial of service.
✅ After investigation, it is confirmed that no plugins on the Catalog were affected. There is no known impact.

Details

The vulnerability resides in the WASM plugin extraction logic, specifically in the unzipFile function (/plugins/client.go). The application constructs file paths during ZIP extraction using filepath.Join(destDir, f.Name) without validating or sanitizing f.Name. If the ZIP archive contains entries with ../, the resulting path can escape the intended directory, allowing writes to arbitrary locations on the host filesystem.

Attack Requirements

There are several requirements needed to make this attack possible:

• The Traefik server should be deployed with plugins enabled with a WASM plugin (yaegi plugins are not impacted).
• The attacker should have write access to a remote plugin asset loaded by the Traefik server
• The attacker should craft a malicious version of this plugin

Warning

As clearly stated in the documentation, plugins are experimental in Traefik, and unsafe plugins could damage your infrastructure:

Experimental Features
Plugins can change the behavior of Traefik in unforeseen ways. Exercise caution when adding new plugins to production Traefik instances.

This vulnerability did not affect any plugin from the catalog. There is no known impact.
Additionally, the catalog will also prevent any compromised plugin to be available across all Traefik versions.
This vulnerability can allow an attacker to perform arbitrary file write outside the intended plugin extraction directory by crafting a malicious ZIP archive that includes ../ (directory traversal) in file paths.

Input manipulates file paths to reach files outside the intended directory, such as configuration or credential files. Typical impact: unauthorized file read or write outside the intended directory.

Kodem intelligence

1. What is CVE-2025-54386? CVE-2025-54386 is a high-severity path traversal vulnerability in github.com/traefik/traefik/v2 (go), affecting versions <= 2.11.27. It is fixed in 2.11.28, 3.4.5, 3.5.0. Input manipulates file paths to reach files outside the intended directory, such as configuration or credential files.
2. Which packages are affected by CVE-2025-54386?
   • github.com/traefik/traefik/v2 (go) (versions <= 2.11.27)
   • github.com/traefik/traefik/v3 (go) (versions <= 3.4.4)
3. Is there a fix for CVE-2025-54386? Yes. CVE-2025-54386 is fixed in 2.11.28, 3.4.5, 3.5.0. Upgrade to this version or later.
4. Is CVE-2025-54386 exploitable, and should I be worried? Whether CVE-2025-54386 is exploitable in your environment depends on whether the vulnerable code is present and reachable. A CVSS score is a worst-case rating; it does not account for your specific deployment, configuration, or usage patterns. Kodem, an Intelligent Application Security platform, uses runtime intelligence to show which vulnerabilities actually execute in production, so you can focus on the ones that represent real risk. Get a demo
5. What actually determines whether CVE-2025-54386 is exploitable, and how bad it is? Exploitability and impact are not fixed properties of a CVE. They depend on runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A high CVSS score on a dependency that never runs is not the same as real risk. Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter.
6. How do I fix CVE-2025-54386?
   • Upgrade github.com/traefik/traefik/v2 to 2.11.28 or later
   • Upgrade github.com/traefik/traefik/v3 to 3.4.5 or later
   • Upgrade github.com/traefik/traefik/v3 to 3.5.0 or later