CVE-2025-54386: Traefik's Client Plugin is Vulnerable to Path Traversal, Arbitrary File Overwrites and Remote Code Execution
Summary A path traversal vulnerability was discovered in WASM Traefik’s plugin installation mechanism. By supplying a maliciously crafted ZIP archive containing file paths with ../ sequences, an attacker can overwrite arbitrary files on the system outside of the intended plugin directory. This can lead to remote code execution (RCE), privilege escalation, persistence, or denial of service. ✅ After investigation, it is confirmed that no plugins on the Catalog were affected. There is no known impact.
Details The vulnerability resides in the WASM plugin extraction logic, specifically in the unzipFile function (/plugins/client.go). The application constructs file paths during ZIP extraction using filepath.Join(destDir, f.Name) without validating or sanitizing f.Name. If the ZIP archive contains entries with ../, the resulting path can escape the intended directory, allowing writes to arbitrary locations on the host filesystem.
Attack Requirements There are several requirements needed to make this attack possible: - The Traefik server should be deployed with plugins enabled with a WASM plugin (yaegi plugins are not impacted). - The attacker should have write access to a remote plugin asset loaded by the Traefik server - The attacker should craft a malicious version of this plugin
Warning As clearly stated in the documentation, plugins are experimental in Traefik, and unsafe plugins could damage your infrastructure:
Experimental Features Plugins can change the behavior of Traefik in unforeseen ways. Exercise caution when adding new plugins to production Traefik instances.
Impact This vulnerability did not affect any plugin from the catalog. There is no known impact. Additionally, the catalog will also prevent any compromised plugin to be available across all Traefik versions. This vulnerability could allow an attacker to perform arbitrary file write outside the intended plugin extraction directory by crafting a malicious ZIP archive that includes ../ (directory traversal) in file paths.
Other sources
Traefik is an HTTP reverse proxy and load balancer. In versions 2.11.27 and below, 3.0.0 through 3.4.4 and 3.5.0-rc1, a path traversal vulnerability was discovered in WASM Traefik’s plugin installation mechanism. By supplying a maliciously crafted ZIP archive containing file paths with ../ sequences, an attacker can overwrite arbitrary files on the system outside of the intended plugin directory. This can lead to remote code execution (RCE), privilege escalation, persistence, or denial of service. This is fixed in versions 2.11.28, 3.4.5 and 3.5.0.
— MITRE
Affected Software
Remediation
Patch Available
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2025-54386?
CVE-2025-54386 is a high-severity path traversal vulnerability that allows attackers to overwrite arbitrary files on the system.
How do I fix CVE-2025-54386?
To remediate CVE-2025-54386, upgrade to Traefik version 3.5.0 or later, or 3.4.5 or later if using version 3.4.x, or version 2.11.28 if using version 2.11.x.
What software is affected by CVE-2025-54386?
CVE-2025-54386 affects Traefik versions prior to 3.5.0, 3.4.5, and 2.11.28.
What is the nature of the vulnerability in CVE-2025-54386?
CVE-2025-54386 is a path traversal vulnerability that exploits the ZIP archive plugin installation mechanism, leading to potential file overwrites.
Can I mitigate CVE-2025-54386 without upgrading?
Mitigation of CVE-2025-54386 without upgrading is not recommended, as the vulnerability is best addressed through software updates.