Listen to this Post
Traefik, an HTTP reverse proxy and load balancer, contains a path normalization vulnerability in versions prior to 2.11.32 and from 2.11.31 through 3.6.2. When configured with path-based routing using PathPrefix, Path, or PathRegex matchers, the software fails to properly decode URL-encoded restricted characters before applying routing rules. Restricted characters include forward slash (/), backslash (), null byte, semicolon (;), question mark (?), and hash (). An attacker can craft HTTP requests where these characters are percent-encoded (e.g., / is represented as %2F). Traefik’s routing logic does not normalize these encoded sequences correctly, causing a mismatch between the incoming request path and the configured path matchers. Consequently, the request bypasses the intended middleware chain, which often includes critical security controls like authentication, authorization, or rate limiting. For example, a route intended to protect the “/admin/” path using a security middleware can be bypassed by requesting “/admin%2F”. The request is then forwarded directly to the backend service associated with the unprotected route, as the matcher does not recognize “%2F” as a path segment delimiter. This allows unauthorized access to protected administrative or internal endpoints. The vulnerability exploits a discrepancy between how the path is parsed for routing and how it is eventually forwarded. The issue is fixed in versions 2.11.32 and 3.6.3, where path normalization now correctly decodes percent-encoded characters before matching, ensuring the middleware chain is invoked appropriately.
Platform: Traefik
Version: Prior to 2.11.32, 2.11.31-3.6.2
Vulnerability: Path normalization bypass
Severity: MEDIUM
date: 12/08/2025
Prediction: Fixed in 2.11.32/3.6.3
What Undercode Say:
Analytics
Showing bash commands and codes related to the blog
curl -v “http://target.example.com/protected%2Fpath”
traefik –version | grep -E “Version|v2\.|v3\.”
how Exploit:
Request with encoded slash: /admin%2Fdashboard
Use encoded null byte: /path%00bypass
Test with semicolon: /secure%3Bpath
Protection from this CVE
Upgrade to 2.11.32
Upgrade to 3.6.3
Review middleware configuration
Impact:
Security middleware bypass
Unauthorized backend access
Potential data exposure
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: nvd.nist.gov
Extra Source Hub:
Undercode
