Path Traversal in Traefik

CVE-2026-67309

Traefik versions >= v3.7.0 and <= v3.7.7 contain a path traversal vulnerability in the Kubernetes Ingress NGINX provider's RewriteTarget middleware (generated from the nginx.ingress.kubernetes.io/rewrite-target annotation). When an Ingress…

Vulnerability class: Path Traversal (Directory Traversal)

Affected products

Traefik — versions 3.7.0

Weakness classification (CWE)

CWE-22 — Path Traversal

References

disclosure@vulncheck.com (vendor-advisory)
disclosure@vulncheck.com (patch)
disclosure@vulncheck.com (patch)
disclosure@vulncheck.com (third-party-advisory)