CVE-2025-54386: Traefik Client Plugin Path Traversal Vulnerability Leading to Arbitrary File Overwrite
Summary
CVE-2025-54386: A path traversal vulnerability was discovered in WASM Traefik’s plugin installation mechanism. Affects github.com/traefik/traefik/v2 versions < 2.11.28. Fixed in 2.11.28. How to fix ↓
Also tracked for
The same CVE-2025-54386 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Traefik is a modern HTTP reverse proxy and load balancer that makes deploying microservices easy. It integrates with various backends and provides features like dynamic configuration, SSL termination, and support for plugins. The vulnerability in question affects the WASM plugin installation mechanism, which allows users to extend Traefik's functionality. This vulnerability arises from improper handling of file paths during the extraction of ZIP archives, potentially allowing attackers to exploit the system.
Vulnerability Detail
A path traversal vulnerability was discovered in the WASM Traefik's plugin installation mechanism. By supplying a maliciously crafted ZIP archive containing file paths with '../' sequences, an attacker can overwrite arbitrary files on the system outside of the intended plugin directory. This can lead to remote code execution (RCE), privilege escalation, persistence, or denial of service. The vulnerability resides in the unzipFile function, which constructs file paths without validating or sanitizing the input, allowing for directory traversal.
How To Fix
Latest published version: v2.11.60 as of 22 Oct 2026
go get github.com/traefik/traefik/v2@v2.11.60Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
2.11.28
This is the first release that contains the fix.
go get github.com/traefik/traefik/v2@v2.11.28Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, ensure that plugins are disabled in your Traefik configuration until you can apply the necessary updates. You can do this by setting the plugins configuration to false in your Traefik configuration file.
Conclusion
The CVE-2025-54386 vulnerability in Traefik's WASM plugin installation mechanism poses significant risks, including arbitrary file overwrites and potential remote code execution. Users are strongly advised to update to the latest patched versions of Traefik to mitigate these risks. Additionally, utilizing tools like Vulert can help monitor for such vulnerabilities in real-time.
See every vulnerability recorded for github.com/traefik/traefik/v2 →
FAQ
The vulnerability is a path traversal issue that allows attackers to overwrite files outside the intended directory by exploiting the ZIP extraction process.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. You can check if your application is affected by visiting the Vulert playground at Vulert Scanner.
The impacts include arbitrary file overwrites, remote code execution, privilege escalation, and potential denial of service.
No, after investigation, it has been confirmed that no plugins from the Traefik catalog were affected by this vulnerability.
If you cannot update immediately, disable plugins in your Traefik configuration to mitigate the risk until you can apply the patch.
References
Related vulnerabilities
Recent vulnerabilities recorded for github.com/traefik/traefik/v2.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
