Traefik has a possible vulnerability with the path matchers

Vulnerability

Traefik, a popular HTTP reverse proxy and load balancer, contains a path traversal vulnerability in versions prior to 2.11.24, 3.3.6, and 3.4.0-rc2. The issue affects routers using PathPrefix, Path, or PathRegex matchers: when Traefik is configured to route requests to a backend based on a path matcher, a URL containing /../ segments can be normalized, causing the request to be routed to a different backend than intended [1][3].

Exploitation

An attacker can craft an HTTP request with a path like /service/sub-path/../other-path. If the first router expects a path prefix such as /service and a second router expects /service/sub-path, the traversal sequence will cause Traefik to resolve the request to the first router while bypassing any middlewares (e.g., authentication or rate-limiting) that were attached to the second router. The workaround suggested by the vendor is adding a PathRegexp rule to explicitly reject paths containing /../ [3].

Impact

Successful exploitation allows an attacker to reach backend services that should be protected by a middleware chain, effectively bypassing security controls. This could lead to unauthorized access to sensitive functionality or data exposed via those backends.

Mitigation

The vulnerability is fixed in Traefik versions 2.11.24, 3.3.6, and 3.4.0-rc2 [1][3]. Users unable to update immediately should apply the provided workaround: insert a PathRegexp matcher rule to block URLs containing /../ (e.g., !PathRegexp("(?:(/\.\./)+.*)")) into their route definitions.