Predictive Vulnerability Intelligence.

Product

  • Product
  • Pricing
  • Documentation

Company

  • About
  • Partnerships
  • Blog
  • Support

Legal

  • Terms
  • Privacy
  • Data Licensing

© 2026 FAUCET Technologies LLC. All rights reserved.

CVE-2025-54386

31
FAUCET Score

CVE-2025-54386 is a critical path traversal vulnerability affecting Traefik HTTP reverse proxy and load balancer versions 2.11.27 and below, 3.0.0 through 3.4.4, and 3.5.0-rc1. An unauthenticated attacker can exploit this by uploading a specially crafted ZIP archive during WASM plugin installation, allowing them to overwrite arbitrary files outside the intended directory. This can lead to remote code execution, privilege escalation, persistence, or denial of service, as reflected by its CVSS score of 9.8 (CRITICAL). There is currently no evidence of active exploitation, public exploit code, or significant community discussion surrounding this vulnerability.

Impacted Technologies

VendorProductVersion(s)CPE
< 2.11.7CPE matchmatch criteria
cpe:2.3:a:traefik:traefik:*:*:*:*:*:*:*:*
>= 3.0.0, < 3.4.4CPE matchmatch criteria
cpe:2.3:a:traefik:traefik:*:*:*:*:*:*:*:*
3.5.0CPE matchmatch criteria
cpe:2.3:a:traefik:traefik:3.5.0:-:*:*:*:*:*:*
3.5.0CPE matchmatch criteria
cpe:2.3:a:traefik:traefik:3.5.0:rc1:*:*:*:*:*:*
3.5.0CPE matchmatch criteria
cpe:2.3:a:traefik:traefik:3.5.0:rc2:*:*:*:*:*:*

CVSS Data

CVSS version used by this source: 4.0

7.3HIGH

CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:P/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector
NETWORK
Attack Complexity
HIGH
Attack Requirements
PRESENT
Privileges Required
HIGH
User Interaction
PASSIVE
VS Confidentiality
HIGH
VS Integrity
HIGH
VS Availability
HIGH
SS Confidentiality
LOW
SS Integrity
LOW
SS Availability
LOW
Exploit Maturity
NOT_DEFINED
CvssVersion
4.0

Exploit Intelligence

EPSS Score
1.06%
Probability of exploitation in next 30 days
EPSS Percentile
61.0%
Percentile rank of EPSS score among Peer Group
As of 2026-07-27
Model: v2026.06.15
This CVE's current EPSS score of 0.0106 is in the 46th percentile among its peer group of 36,897 CVEs.

Social Chatter

The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.3 Bluesky, 0.3 Mastodon, and 2.4 GitHub mentions.

Media Mentions

No media coverage found for this CVE.

The average CVE in this peer group has 0.3 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.

Remediation

Patch Available

Vendor Patches (5)

github_advisorypatch availablevia nvd_reference
View patch
gopatch availablevia ghsa
Product: github.com/traefik/traefik/v2Fixed in: 2.11.28
gopatch availablevia ghsa
Product: github.com/traefik/traefik/v3Fixed in: 3.4.5
gopatch availablevia ghsa
Product: github.com/traefik/traefik/v3Fixed in: 3.5.0
redhatno patchvia redhat_api
Product: Red Hat OpenShift Dev SpacesFixed in: devspaces/traefik-rhel9

Vendor Advisories (2)

redhatCVE-2025-54386Moderate

traefik: Traefik's Client Plugin is Vulnerable to Path Traversal, Arbitrary File Overwrites and Remote Code Execution

Aug 1, 2025
goGHSA-q6gg-9f92-r9wghigh

Traefik Client Plugin's Path Traversal Vulnerability Allows Arbitrary File Overwrite and Remote Code Execution

Aug 1, 2025

References

github.com / traefik/plugin-service/pull/71
Patch
github.com / traefik/plugin-service/pull/72
Patch
github.com / traefik/traefik/commit/5ef853a0c53068f69a6c229a5815a0dc6e0a8800
Patch
github.com / traefik/traefik/pull/11911
Patch
github.com / traefik/traefik/releases/tag/v2.11.28
Release Notes
github.com / traefik/traefik/security/advisories/GHSA-q6gg-9f92-r9wg
Vendor Advisory