---
id: "GHSA-cp28-5662-543f"
page: "https://infrastack.ai/live/GHSA-cp28-5662-543f"
kind: "vulnerability"
aliases: ["GHSA-cp28-5662-543f"]
title: "sanitizePath does not remove path-parameter dot-segments (/..;x/), enabling path-based authorization bypass"
severity: "high"
cvss: 7.8
epss: null
exploited: false
status: "open"
category: "runtime"
products: [{"name": "github.com/traefik/traefik/v2", "fixed": ["v2.11.62"], "affected": "<= v2.11.61", "ecosystem": "go"}, {"name": "github.com/traefik/traefik/v3", "fixed": ["v3.7.18"], "affected": ">= v3.0.0, <= v3.7.17", "ecosystem": "composer"}, {"name": "github.com/traefik/traefik/v3", "fixed": ["v3.8.0-rc.2"], "affected": ">= v3.8.0-rc.1, <= v3.8.0-rc.1", "ecosystem": "go"}]
ecosystems: ["composer", "go"]
tags: ["composer", "cwe-22", "cwe-436", "go", "kubernetes", "runtime", "self-hosted", "traefik"]
not_affected_if: ["default-config-disabled-sanitizepath", "no-auth-middleware", "no-shared-backend"]
published_at: "2026-11-12T10:01:23+00:00"
first_seen_at: "2026-11-12T10:09:07+00:00"
updated_at: "2026-11-12T10:10:17+00:00"
sources: [{"source": "ghsa-repo", "url": "https://github.com/traefik/traefik/security/advisories/GHSA-cp28-5662-543f", "first_seen_at": "2026-11-12T10:09:07+00:00"}]
exploit_sources: []
---

# sanitizePath does not remove path-parameter dot-segments (/..;x/), enabling path-based authorization bypass

Link for people: https://infrastack.ai/live/GHSA-cp28-5662-543f (this .md is for agents)

Traefik's sanitizePath option does not resolve dot-segments carrying path parameters, such as /..;x/, before routing. An unauthenticated attacker can send one request like /public/..;x/admin to reach protected backend resources and skip the authentication or authorization middleware.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- go:github.com/traefik/traefik/v2 affected <= v2.11.61 fixed v2.11.62
- composer:github.com/traefik/traefik/v3 affected >= v3.0.0, <= v3.7.17 fixed v3.7.18
- go:github.com/traefik/traefik/v3 affected >= v3.8.0-rc.1, <= v3.8.0-rc.1 fixed v3.8.0-rc.2

## How to check

- Check the Traefik version with `traefik version` and compare it against the fixed versions below.
- Look for routers on the same backend where one router is unauthenticated and another is protected by an auth middleware.
- Check that the backend strips path parameters (Servlet containers, Spring) and that `sanitizePath` is enabled (the default).

## Fix

- Traefik v2: `2.11.62`
- Traefik v3.7 line: `3.7.18`
- Traefik v3.8 release candidate: `3.8.0-rc.2`
- Traefik v3.0 to v3.6 are end of life and will not be patched; upgrade to a patched release.

## Timeline

- 2026-11-12T10:09:07+00:00 ghsa-repo https://github.com/traefik/traefik/security/advisories/GHSA-cp28-5662-543f

## Documents

- [advisory] Maintainer's advisory: github.com https://github.com/traefik/traefik/security/advisories/GHSA-cp28-5662-543f

## From the sources

## Summary

There is a vulnerability in Traefik's request path sanitization. The `sanitizePath` entry point option, enabled by default, resolves the `..` and `.` dot-segments and removes the duplicate slashes from the request path before routing, but it leaves a dot-segment carrying a path parameter, such as `/..;x/`, untouched. Traefik matches its routers and applies its middlewares on this unresolved path and forwards it unchanged. When a backend that strips path parameters (Servlet containers, Spring, ...) is shared between an unauthenticated router and a router protected by an authentication or authorization middleware, an unauthenticated attacker can send a single request such as `/public/..;x/admin` to reach the protected resources and bypass the middleware.

Traefik v2.11.62, v3.7.18 and v3.8.0-rc.2 resolve the `..`, `.` and empty segments carrying path parameters before the dot-segment removal, when `sanitizePath` is enabled (the default). Traefik v3.0 to v3.6 are also affected; these lines are end of life and will not receive a patch, the remedy is to upgrade to a patched release.

## Patches

- https://github.com/traefik/traefik/releases/tag/v2.11.62
- https://github.com/traefik/traefik/releases/tag/v3.7.18
- https://github.com/traefik/traefik/releases/tag/v3.8.0-rc.2

## For more information

If you have any questions or comments about this advisory, please [open an issue](https://github.com/traefik/traefik/issues).

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_