Vulnérabilité de Traversal de Chemin dans le Plugin Client de Traefik Permet l'Écrasement Arbitraire de Fichiers et l'Exécution de Code à Distance dans github.com/traefik/traefik

The core of this vulnerability lies in a path traversal flaw within the Traefik Client Plugin. An attacker can craft malicious requests that manipulate file paths, allowing them to write data to locations outside of the intended plugin directory. This arbitrary file overwrite capability can be leveraged to overwrite critical system files, inject malicious code, or gain persistent access to the system. Successful exploitation could lead to complete system takeover, data exfiltration, and denial of service. The impact is particularly severe given Traefik's role as a reverse proxy, often sitting in front of critical applications and services.

Organizations utilizing Traefik as a reverse proxy, particularly those with the Client Plugin feature enabled, are at risk. This includes environments with custom plugins or integrations, as well as those relying on Traefik for securing critical web applications. Shared hosting environments where multiple users share the same Traefik instance are also at increased risk.

• go / server:

ps aux | grep traefik

• go / server:

journalctl -u traefik -f | grep "path traversal"

• generic web:

curl -I <traefik_endpoint>/clientplugin/malicious_path

• generic web:

grep -r "path traversal" /etc/traefik/traefik.yml

1. 2025-08-11Disclosure

   disclosure

1. Réservé2025-07-21
2. Publiée2025-08-11
3. Modifiée2026-02-04
4. EPSS mis à jour2026-03-23

The primary mitigation for CVE-2025-54386 is to upgrade Traefik to version 2.11.28 or later. If an immediate upgrade is not feasible due to compatibility concerns or breaking changes, consider temporarily disabling the Client Plugin feature to reduce the attack surface. While not a complete fix, implementing strict input validation and sanitization on any user-provided data used in file paths within the plugin can help mitigate the risk. Monitor Traefik logs for unusual file access patterns or attempts to access restricted directories. After upgrading, confirm the fix by attempting to trigger the path traversal vulnerability with a known malicious payload and verifying that the attempt is blocked.