GITHUB.COM/TRAEFIK/TRAEFIK/V2 · GHSA-cp28-5662-543f · Runtime
FIX → v2.11.62 · v3.8.0-rc.2 +1
Traefik's sanitizePath option does not resolve dot-segments carrying path parameters, such as /..;x/, before routing. An unauthenticated attacker can send one request like /public/..;x/admin to reach protected backend resources and skip the authentication or authorization middleware.
first public Nov 12, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Deployments where Traefik routes requests to a backend that strips path parameters, such as a Servlet container or Spring application, and that backend is shared between an unauthenticated router and a router protected by an authentication or authorization middleware. Deployments where each protected backend is isolated, or that do not use auth middleware, are less exposed.
Not affected if default-config-disabled-sanitizepath, no-auth-middleware, no-shared-backend
Who cares composer, go, kubernetes, self-hosted, traefik
traefik version and compare it against the fixed versions below.sanitizePath is enabled (the default).There is a vulnerability in Traefik's request path sanitization. The sanitizePath entry point option, enabled by default, resolves the .. and . dot-segments and removes the duplicate slashes from the request path before routing, but it leaves a dot-segment carrying a path parameter, such as /..;x/, untouched. Traefik matches its routers and applies its middlewares on this unresolved path and forwards it unchanged. When a backend that strips path parameters (Servlet containers, Spring, ...) is shared between an unauthenticated router and a router protected by an authentication or authorization middleware, an unauthenticated attacker can send a single request such as /public/..;x/admin to reach the protected resources and bypass the middleware.
Traefik v2.11.62, v3.7.18 and v3.8.0-rc.2 resolve the .., . and empty segments carrying path parameters before the dot-segment removal, when sanitizePath is enabled (the default). Traefik v3.0 to v3.6 are also affected; these lines are end of life and will not receive a patch, the remedy is to upgrade to a patched release.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.
Upgrade to v2.11.62 · v3.8.0-rc.2 +1
2.11.623.7.183.8.0-rc.2If you have any questions or comments about this advisory, please open an issue.