Traefik CVE-2025-66490

Exploitation requires Traefik to be configured for path-based routing using PathPrefix, Path, or PathRegex matchers, where a security/access-control middleware (e.g. a blocking replacePathRegex rule or auth middleware) is attached to a specific protected path while another router also serves the same backend. The attacker must know (or guess) the protected endpoint and include a URL-encoded restricted character from the set ('/', '\', Null, ';', '?', '#') in the request path. No authentication or user interaction is needed (PR:N/UI:N). What LIMITS exploitation: it is ineffective against deployments that do not rely on path-based routing + middleware for access control, and the actual impact depends entirely on what the bypassed middleware was protecting; default configurations without path-protecting middleware are not exposed.

Signals are moderate and internally consistent. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) shows a remotely reachable, low-complexity, unauthenticated flaw, but the impact is deliberately scoped to the subsequent/backend system (VC:N/VI:N/VA:N, SC:L/SI:L) - Traefik itself is not compromised; rather, security middleware is bypassed so a protected backend path is reached, yielding the base score of 6.9 (Medium). EPSS is low at 0.44% (37th percentile), and the vulnerability is NOT listed in CISA KEV, so there is no evidence of active exploitation. However, publicly available exploit code exists - the GHSA advisory embeds a working PoC discovered during PwnSec CTF 2025 - so weaponization effort is near zero. The net picture: this is a real, low-complexity, unauthenticated access-control bypass with a public PoC, but real-world risk is gated by configuration (it only matters where path-based routing protects sensitive endpoints with middleware). Treat as a meaningful patch priority for environments using Traefik PathPrefix/Path/PathRegex matchers with security middleware, but not an emergency 'drop everything' issue given low EPSS and no KEV. Note a version-data conflict: the description and NVD CPEs state the v3 fix is 3.6.3, while the linked release/advisory point to v3.6.4 - verify the exact fixed v3 build with the vendor.

An unauthenticated remote attacker who knows an internal/admin path is protected by Traefik middleware sends a request with a URL-encoded restricted character (e.g. GET /admin%2F or POST /%2freport_note). Traefik matches the router rule against the still-encoded path, misses the protected prefix, skips the security middleware chain, then decodes the path and forwards it to the backend - reaching the protected endpoint. A public PoC exists in the GHSA advisory, making this trivially reproducible given low attack complexity (AC:L).