Vulnerability in Traefik
CVE-2025-66490
Traefik is an HTTP reverse proxy and load balancer. For versions prior to 2.11.32 and 2.11.31 through 3.6.2, requests using PathPrefix, Path or PathRegex matchers can bypass path normalization. When Traefik uses path-based routing, requests containing URL-encoded restricted characters (/, \, Null, ;, ?, #) can bypass the middleware chain and reach unintended backends. For example, a request to http://mydomain.example.com/admin%2F could reach service-a without triggering my-security-middleware, bypassing security controls for the /admin/ path. This issue is fixed in versions 2.11.32 and 3.6.3.
Published · last modified .
CVSS v3 metric
CVSS v3 base score 6.5 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N.
EPSS exploit prediction
EPSS: 0.004 (28.0th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 28th percentile — 28.0% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.004 · newest: 0.004 · change: -0.000
Affected products
- Traefik — versions github.com/traefik/traefik/v3 < 3.6.3, github.com/traefik/traefik/v2 < 2.11.32, github.com/traefik/traefik <= 1.7.34
Weakness classification (CWE)
References
- github.com/traefik/traefik/security/advisories/GHSA-gm3x-23wp-hc2c (Exploit, Vendor Advisory)
- github.com/traefik/traefik/releases/tag/v2.11.32 (Release Notes)
- github.com/traefik/traefik/releases/tag/v3.6.4 (Release Notes)
Frequently asked questions
- What is CVE-2025-66490?
- CVE-2025-66490 is a medium-severity vulnerability in Traefik, classified under CWE-436. CVSS score: 6.5/10. Published 2025-12-09.
- How severe is CVE-2025-66490?
- Medium severity. CVSS v3 base score is 6.5 out of 10.