{"id":"GHSA-cp28-5662-543f","kind":"vulnerability","aliases":["GHSA-cp28-5662-543f"],"related":[],"title":"sanitizePath does not remove path-parameter dot-segments (/..;x/), enabling path-based authorization bypass","description":"## Summary\r\n\r\nThere is a vulnerability in Traefik's request path sanitization. The `sanitizePath` entry point option, enabled by default, resolves the `..` and `.` dot-segments and removes the duplicate slashes from the request path before routing, but it leaves a dot-segment carrying a path parameter, such as `/..;x/`, untouched. Traefik matches its routers and applies its middlewares on this unresolved path and forwards it unchanged. When a backend that strips path parameters (Servlet containers, Spring, ...) is shared between an unauthenticated router and a router protected by an authentication or authorization middleware, an unauthenticated attacker can send a single request such as `/public/..;x/admin` to reach the protected resources and bypass the middleware.\r\n\r\nTraefik v2.11.62, v3.7.18 and v3.8.0-rc.2 resolve the `..`, `.` and empty segments carrying path parameters before the dot-segment removal, when `sanitizePath` is enabled (the default). Traefik v3.0 to v3.6 are also affected; these lines are end of life and will not receive a patch, the remedy is to upgrade to a patched release.\r\n\r\n## Patches\r\n\r\n- https://github.com/traefik/traefik/releases/tag/v2.11.62\r\n- https://github.com/traefik/traefik/releases/tag/v3.7.18\r\n- https://github.com/traefik/traefik/releases/tag/v3.8.0-rc.2\r\n\r\n## For more information\r\n\r\nIf you have any questions or comments about this advisory, please [open an issue](https://github.com/traefik/traefik/issues).","summary":"Traefik's sanitizePath option does not resolve dot-segments carrying path parameters, such as /..;x/, before routing. An unauthenticated attacker can send one request like /public/..;x/admin to reach protected backend resources and skip the authentication or authorization middleware.","severity":"high","cvss":7.8,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"github.com/traefik/traefik/v2","fixed":["v2.11.62"],"affected":"<= v2.11.61","ecosystem":"go"},{"name":"github.com/traefik/traefik/v3","fixed":["v3.7.18"],"affected":">= v3.0.0, <= v3.7.17","ecosystem":"composer"},{"name":"github.com/traefik/traefik/v3","fixed":["v3.8.0-rc.2"],"affected":">= v3.8.0-rc.1, <= v3.8.0-rc.1","ecosystem":"go"}],"ecosystems":["composer","go"],"tags":["composer","cwe-22","cwe-436","go","kubernetes","runtime","self-hosted","traefik"],"not_affected_if":["default-config-disabled-sanitizepath","no-auth-middleware","no-shared-backend"],"how_to_check":"- Check the Traefik version with `traefik version` and compare it against the fixed versions below.\n- Look for routers on the same backend where one router is unauthenticated and another is protected by an auth middleware.\n- Check that the backend strips path parameters (Servlet containers, Spring) and that `sanitizePath` is enabled (the default).","fix":"- Traefik v2: `2.11.62`\n- Traefik v3.7 line: `3.7.18`\n- Traefik v3.8 release candidate: `3.8.0-rc.2`\n- Traefik v3.0 to v3.6 are end of life and will not be patched; upgrade to a patched release.","status":"open","published_at":"2026-11-12T10:01:23+00:00","first_seen_at":"2026-11-12T10:09:07+00:00","triaged_at":"2026-11-12T10:10:17+00:00","updated_at":"2026-11-12T10:10:17+00:00","category":"runtime","confidence":0.85,"triage":{"at":"2026-11-12T10:10:17Z","model":"claude-haiku-5-5","output":{"fix":"- Traefik v2: `2.11.62`\n- Traefik v3.7 line: `3.7.18`\n- Traefik v3.8 release candidate: `3.8.0-rc.2`\n- Traefik v3.0 to v3.6 are end of life and will not be patched; upgrade to a patched release.","reach":"internet","title":"Traefik: path parameters bypass route authentication middleware on shared backends","impact":"high","summary":"Traefik's sanitizePath option does not resolve dot-segments carrying path parameters, such as /..;x/, before routing. An unauthenticated attacker can send one request like /public/..;x/admin to reach protected backend resources and skip the authentication or authorization middleware.","audience":"businesses","category":"runtime","nicknames":[],"who_cares":["traefik","self-hosted","kubernetes","go","composer"],"confidence":0.85,"fix_status":"available","needs_auth":"no","worst_case":"Unauthenticated requests reach protected backend resources and bypass access control.","analyst_note":"","how_to_check":"- Check the Traefik version with `traefik version` and compare it against the fixed versions below.\n- Look for routers on the same backend where one router is unauthenticated and another is protected by an auth middleware.\n- Check that the backend strips path parameters (Servlet containers, Spring) and that `sanitizePath` is enabled (the default).","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["default-config-disabled-sanitizepath","no-shared-backend","no-auth-middleware"],"who_is_affected":"Deployments where Traefik routes requests to a backend that strips path parameters, such as a Servlet container or Spring application, and that backend is shared between an unauthenticated router and a router protected by an authentication or authorization middleware. Deployments where each protected backend is isolated, or that do not use auth middleware, are less exposed.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.00087,"input_tokens":5170,"output_tokens":706,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-22':41B '-436':43B '-543':22A,28A '/public':77B,194C '/traefik/traefik/issues).':287C '/traefik/traefik/releases/tag/v2.11.62':261C '/traefik/traefik/releases/tag/v3.7.18':264C '/traefik/traefik/releases/tag/v3.8.0-rc.2':267C '/traefik/traefik/v2':32A '/traefik/traefik/v3':35A,38A '5662':21A,27A 'advisori':280C 'affect':236C 'also':235C 'appli':147C 'attack':71B,186C 'authent':87B,180C 'author':16A,89B,182C 'backend':82B,160C 'base':15A 'bypass':17A,202C 'carri':61B,134C,215C 'comment':277C 'compos':39B 'contain':166C 'cp28':20A,26A 'cwe':40B,42B 'default':109C,229C 'dot':9A,59B,114C,132C,221C 'dot-seg':8A,58B,113C,131C,220C 'duplic':119C 'empti':213C 'enabl':12A,107C,227C 'end':240C 'entri':104C 'f':23A,29A 'forward':155C 'ghsa':19A,25A 'ghsa-cp28':18A,24A 'github.com':31A,34A,37A,260C,263C,266C,286C 'github.com/traefik/traefik/issues).':285C 'github.com/traefik/traefik/releases/tag/v2.11.62':259C 'github.com/traefik/traefik/releases/tag/v3.7.18':262C 'github.com/traefik/traefik/releases/tag/v3.8.0-rc.2':265C 'github.com/traefik/traefik/v2':30A 'github.com/traefik/traefik/v3':33A,36A 'go':44B 'host':49B 'inform':270C 'issu':284C 'kubernet':45B 'leav':129C 'life':242C 'like':76B 'line':238C 'match':143C 'middlewar':90B,149C,183C,204C 'one':74B 'open':282C 'option':54B,106C 'paramet':7A,63B,137C,164C,217C 'patch':248C,256C,258C 'path':6A,14A,62B,100C,124C,136C,153C,163C,216C 'path-bas':13A 'path-paramet':5A 'pleas':281C 'point':105C 'protect':81B,177C,199C 'question':275C 'reach':80B,197C 'receiv':246C 'releas':257C 'remedi':250C 'remov':4A,117C,223C 'request':75B,99C,123C,191C 'resolv':57B,110C,210C 'resourc':83B,200C 'rout':68B,126C 'router':145C,173C,176C 'runtim':46B 'sanit':101C 'sanitizepath':1A,53B,103C,225C 'segment':10A,60B,115C,133C,214C,222C 'self':48B 'self-host':47B 'send':73B,188C 'servlet':165C 'share':169C 'singl':190C 'skip':85B 'slash':120C 'spring':167C 'strip':162C 'summari':91C 'traefik':50B,51B,97C,142C,205C,230C 'unauthent':70B,172C,185C 'unchang':157C 'unresolv':152C 'untouch':141C 'upgrad':253C 'v2.11.62':206C 'v3.0':231C 'v3.6':233C 'v3.7.18':207C 'v3.8.0-rc.2':209C 'vulner':95C 'x':11A,66B,140C 'x/admin':78B,195C","nicknames":[],"mitigations":[],"who_affected":"Deployments where Traefik routes requests to a backend that strips path parameters, such as a Servlet container or Spring application, and that backend is shared between an unauthenticated router and a router protected by an authentication or authorization middleware. Deployments where each protected backend is isolated, or that do not use auth middleware, are less exposed.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["githubcomtraefiktraefikv2","githubcomtraefiktraefikv3"],"ptokens":["com","github","traefik","v2","v3"],"labels":["composer","cwe22","cwe436","go","high","kubernetes","runtime","selfhosted","traefik"],"campaign_type":null,"search_a":"'-543':22A,28A '/traefik/traefik/v2':32A '/traefik/traefik/v3':35A,38A '5662':21A,27A 'author':16A 'base':15A 'bypass':17A 'cp28':20A,26A 'dot':9A 'dot-seg':8A 'enabl':12A 'f':23A,29A 'ghsa':19A,25A 'ghsa-cp28':18A,24A 'github.com':31A,34A,37A 'github.com/traefik/traefik/v2':30A 'github.com/traefik/traefik/v3':33A,36A 'paramet':7A 'path':6A,14A 'path-bas':13A 'path-paramet':5A 'remov':4A 'sanitizepath':1A 'segment':10A 'x':11A","search_b":"'-22':41B '-436':43B '/public':77B 'attack':71B 'authent':87B 'author':89B 'backend':82B 'carri':61B 'compos':39B 'cwe':40B,42B 'dot':59B 'dot-seg':58B 'go':44B 'host':49B 'kubernet':45B 'like':76B 'middlewar':90B 'one':74B 'option':54B 'paramet':63B 'path':62B 'protect':81B 'reach':80B 'request':75B 'resolv':57B 'resourc':83B 'rout':68B 'runtim':46B 'sanitizepath':53B 'segment':60B 'self':48B 'self-host':47B 'send':73B 'skip':85B 'traefik':50B,51B 'unauthent':70B 'x':66B 'x/admin':78B","search_c":"'/public':194C '/traefik/traefik/issues).':287C '/traefik/traefik/releases/tag/v2.11.62':261C '/traefik/traefik/releases/tag/v3.7.18':264C '/traefik/traefik/releases/tag/v3.8.0-rc.2':267C 'advisori':280C 'affect':236C 'also':235C 'appli':147C 'attack':186C 'authent':180C 'author':182C 'backend':160C 'bypass':202C 'carri':134C,215C 'comment':277C 'contain':166C 'default':109C,229C 'dot':114C,132C,221C 'dot-seg':113C,131C,220C 'duplic':119C 'empti':213C 'enabl':107C,227C 'end':240C 'entri':104C 'forward':155C 'github.com':260C,263C,266C,286C 'github.com/traefik/traefik/issues).':285C 'github.com/traefik/traefik/releases/tag/v2.11.62':259C 'github.com/traefik/traefik/releases/tag/v3.7.18':262C 'github.com/traefik/traefik/releases/tag/v3.8.0-rc.2':265C 'inform':270C 'issu':284C 'leav':129C 'life':242C 'line':238C 'match':143C 'middlewar':149C,183C,204C 'open':282C 'option':106C 'paramet':137C,164C,217C 'patch':248C,256C,258C 'path':100C,124C,136C,153C,163C,216C 'pleas':281C 'point':105C 'protect':177C,199C 'question':275C 'reach':197C 'receiv':246C 'releas':257C 'remedi':250C 'remov':117C,223C 'request':99C,123C,191C 'resolv':110C,210C 'resourc':200C 'rout':126C 'router':145C,173C,176C 'sanit':101C 'sanitizepath':103C,225C 'segment':115C,133C,214C,222C 'send':188C 'servlet':165C 'share':169C 'singl':190C 'slash':120C 'spring':167C 'strip':162C 'summari':91C 'traefik':97C,142C,205C,230C 'unauthent':172C,185C 'unchang':157C 'unresolv':152C 'untouch':141C 'upgrad':253C 'v2.11.62':206C 'v3.0':231C 'v3.6':233C 'v3.7.18':207C 'v3.8.0-rc.2':209C 'vulner':95C 'x':140C 'x/admin':195C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-12T10:01:23+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"ghsa-repo","external_id":"GHSA-cp28-5662-543f","url":"https://github.com/traefik/traefik/security/advisories/GHSA-cp28-5662-543f","severity":"high","published_at":"2026-11-12T10:01:23+00:00","modified_at":"2026-11-12T10:01:23+00:00","first_seen_at":"2026-11-12T10:09:07+00:00","fetched_at":"2026-11-12T10:09:07+00:00","note":null}],"documents":[{"id":133900,"url":"https://github.com/traefik/traefik/security/advisories/GHSA-cp28-5662-543f","title":"Maintainer's advisory: github.com","kind":"vendor","source":"ghsa-repo","publisher":"vendor","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Maintainer's advisory: github.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}