Your RSA-2048 keys break in 2030. Find every one of them before attackers do.
🐹 Go
Not in CISA KEV

GHSA-6p68-w45g-48j7 — traefik

Fix: traefik/traefik#11684

GHSA-6p68-w45g-48j7 is a Path Traversal vulnerability in github.com/traefik/traefik. A fix is available for github.com/traefik/traefik — see the affected versions and patch details below.

Traefik has a possible vulnerability with its path matchers

Also known asCVE-2025-32431GO-2025-3634
Published
Apr 21, 2025
Updated
Nov 27, 2025
Affected
4 pkgs
Patched
3 / 4
Exploits
None indexed
Exploitation data as of Sep 27, 2026 · OSV.dev, NVD, FIRST.org (EPSS)

Exploitation Status

No confirmed exploitation observed yet

  • CISA assesses this as automatable — exploitation doesn’t require manual, per-target effort, which raises the odds of mass scanning and opportunistic attacks.
  • A successful exploit gives an attacker total control of the affected component, not partial access.
  • CISA’s own triage has not observed active exploitation or public proof-of-concept code for this CVE as of its last assessment.

Exploitation and automatability from CISA’s SSVC triage for GHSA-6p68-w45g-48j7.

EPSS Exploitation Probability

via FIRST.org ↗
0.9%probability of exploitation in next 30 days
Lower Risk0.00%
Lower risk than most CVEs59th percentile — riskier than 59% of all scored CVEsHighest risk

Probability of exploitation in the next 30 days, from FIRST.org EPSS.

Real-World Exposure

4 pkgs affected
🐹github.com/traefik/traefik🐹github.com/traefik/traefik/v2🐹github.com/traefik/traefik/v3🐹github.com/traefik/traefik/v3

Real-time download stats are indexed for npm and PyPI packages. This vulnerability affects Go packages — download data is not available via public APIs for these ecosystems.

Description

Impact

There is a potential vulnerability in Traefik managing the requests using a PathPrefix, Path or PathRegex matcher.

When Traefik is configured to route the requests to a backend using a matcher based on the path, if the URL contains a /../ in its path, it’s possible to target a backend, exposed using another router, by-passing the middlewares chain.

Example

apiVersion: traefik.io/v1alpha1
kind: IngressRoute
metadata:
  name: my-service
spec:
  routes:
    - match: PathPrefix(‘/service’)
      kind: Rule
      services:
        - name: service-a
          port: 8080
      middlewares:
        - name: my-middleware-a
    - match: PathPrefix(‘/service/sub-path’)
      kind: Rule
      services:
        - name: service-a
          port: 8080

In such a case, the request http://mydomain.example.com/service/sub-path/../other-path will reach the backend my-service-a without operating the middleware my-middleware-a unless the computed path is http://mydomain.example.com/service/other-path and should be computes by the first router (operating my-middleware-a).

Patches

Workaround

Add a PathRegexp rule to the matcher to prevent matching a route with a /../ in the path.

Example:

match: PathPrefix(`/service`) && !PathRegexp(`(?:(/\.\./)+.*)`)

For more information

If you have any questions or comments about this advisory, please open an issue.

Affected Packages

4 total 3 fixed
EcosystemPackageVulnerable rangeFix
🐹Gogithub.com/traefik/traefikall versionsNo fix
🐹Gogithub.com/traefik/traefik/v2all versions2.11.23go get github.com/traefik/traefik/v2@v2.11.23
🐹Gogithub.com/traefik/traefik/v3all versions3.3.6go get github.com/traefik/traefik/v3@v3.3.6
🐹Gogithub.com/traefik/traefik/v3≥ 3.4.0-rc1&&< 3.4.0-rc23.4.0-rc2go get github.com/traefik/traefik/v3@v3.4.0-rc2

Affected Products

1 product · 4 configurations
Application
traefiktraefik
≥ 3.0.0 && < 3.3.6
1 version
3.4.0

Detection & mitigation playbook

Open-source dependency

  1. Detect

    Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for github.com/traefik/traefik, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.

  2. Fix

    No patched version of github.com/traefik/traefik has shipped for GHSA-6p68-w45g-48j7 yet. Where your build allows, override or pin the dependency away from the vulnerable range, and apply any maintainer-recommended mitigation.

  3. Workarounds

    Resolve every user-supplied path to its canonical form and reject anything that escapes the intended directory, and run the component under an account that has no read or write access outside the directory it legitimately serves.

Frequently Asked Questions

## Impact There is a potential vulnerability in Traefik managing the requests using a `PathPrefix`, `Path` or `PathRegex` matcher. When Traefik is configured to route the requests to a backend using a matcher based on the path, if the URL contains a `/../` in its path, it’s possible to target a backend, exposed using another router, by-passing the middlewares chain. ## Example ```yaml apiVersion: traefik.io/v1alpha1 kind: IngressRoute metadata: name: my-service spec: routes: - match: PathPrefix(‘/service’) kind: Rule services: - name: service-a port: 8
O3 Security · Impact-Aware SCA

Is GHSA-6p68-w45g-48j7 in your dependencies?

Find it across Go, including transitive dependencies.

Scan my dependencies How O3 SCA works
GHSA-6p68-w45g-48j7: traefik | O3 Security