CVE-2025-66490
published 2025-12-09CVE-2025-66490: Traefik is an HTTP reverse proxy and load balancer. For versions prior to 2.11.32 and 2.11.31 through 3.6.2, requests using PathPrefix, Path or PathRegex…
PriorityP341medium6.5CVSS 3.1
AVNACLPRNUINSUCLILAN
EPSS
0.33%
24.8th percentile
Traefik is an HTTP reverse proxy and load balancer. For versions prior to 2.11.32 and 2.11.31 through 3.6.2, requests using PathPrefix, Path or PathRegex matchers can bypass path normalization. When Traefik uses path-based routing, requests containing URL-encoded restricted characters (/, \, Null, ;, ?, #) can bypass the middleware chain and reach unintended backends. For example, a request to http://mydomain.example.com/admin%2F could reach service-a without triggering my-security-middleware, bypassing security controls for the /admin/ path. This issue is fixed in versions 2.11.32 and 3.6.3.
Affected
8 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| github.com | traefik_traefik | 0 – 1.7.34 | — |
| github.com | traefik_traefik_v2 | >= 0 < 2.11.32 | 2.11.32 |
| github.com | traefik_traefik_v3 | >= 0 < 3.6.3 | 3.6.3 |
| traefik | traefik | < 2.11.32 | 2.11.32 |
| traefik | traefik | — | — |
| traefik | traefik | — | — |
| traefik | traefik | — | — |
| traefik | traefik | >= 3.0.0 < 3.6.3 | 3.6.3 |
CVSS provenance
nvdv3.16.5MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
nvdv4.06.9MEDIUMCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vendor_redhat6.9MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
github.com/traefik/traefik: Traefik Path Normalization Bypass in Router + Middleware Rules
vendor_redhat·2025-12-09·CVSS 6.9
CVE-2025-66490 [MEDIUM] CWE-436 github.com/traefik/traefik: Traefik Path Normalization Bypass in Router + Middleware Rules
github.com/traefik/traefik: Traefik Path Normalization Bypass in Router + Middleware Rules
Traefik is an HTTP reverse proxy and load balancer. For versions prior to 2.11.32 and 2.11.31 through 3.6.2, requests using PathPrefix, Path or PathRegex matchers can bypass path normalization. When Traefik uses path-based routing, requests containing URL-encoded restricted characters (/, \, Null, ;, ?, #) can bypass the middleware chain and reach unintended backends. For example, a request to http://mydomain.example.com/admin%2F could reach service-a without triggering my-security-middleware, bypassing security controls for the /admin/ path. This issue is fixed in versions 2.11.32 and 3.6.3.
A path normalization bypass has been discovered in Traefik. When Traefik is configured to route the request
OSV
Path Normalization Bypass in Traefik Router + Middleware Rules in github.com/traefik/traefik
osv·2025-12-15
CVE-2025-66490 Path Normalization Bypass in Traefik Router + Middleware Rules in github.com/traefik/traefik
Path Normalization Bypass in Traefik Router + Middleware Rules in github.com/traefik/traefik
Path Normalization Bypass in Traefik Router + Middleware Rules in github.com/traefik/traefik
OSV
Path Normalization Bypass in Traefik Router + Middleware Rules
osv·2025-12-08
CVE-2025-66490 [MEDIUM] Path Normalization Bypass in Traefik Router + Middleware Rules
Path Normalization Bypass in Traefik Router + Middleware Rules
## Impact
There is a potential vulnerability in Traefik managing the requests using a `PathPrefix`, `Path` or `PathRegex` matcher.
When Traefik is configured to route the requests to a backend using a matcher based on the path; if the request path contains an encoded restricted character from the following set **('/', '\', 'Null', ';', '?', '#')**, it’s possible to target a backend, exposed using another router, by-passing the middlewares chain.
## Example
```yaml
apiVersion: traefik.io/v1alpha1
kind: IngressRoute
metadata:
name: my-service
spec:
routes:
- match: PathPrefix(‘/admin/’)
kind: Rule
services:
- name: service-a
port: 8080
middlewares:
- name: my-security-middleware
- match: PathPrefix(‘/’)
kind: Rule
services:
GHSA
Path Normalization Bypass in Traefik Router + Middleware Rules
ghsa·2025-12-08
CVE-2025-66490 [MEDIUM] CWE-436 Path Normalization Bypass in Traefik Router + Middleware Rules
Path Normalization Bypass in Traefik Router + Middleware Rules
## Impact
There is a potential vulnerability in Traefik managing the requests using a `PathPrefix`, `Path` or `PathRegex` matcher.
When Traefik is configured to route the requests to a backend using a matcher based on the path; if the request path contains an encoded restricted character from the following set **('/', '\', 'Null', ';', '?', '#')**, it’s possible to target a backend, exposed using another router, by-passing the middlewares chain.
## Example
```yaml
apiVersion: traefik.io/v1alpha1
kind: IngressRoute
metadata:
name: my-service
spec:
routes:
- match: PathPrefix(‘/admin/’)
kind: Rule
services:
- name: service-a
port: 8080
middlewares:
- name: my-security-middleware
- match: PathPrefix(‘/’)
kind: Rule
services:
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2025-12-09
Published