Go/github.com/traefik/traefik/v2 CVE-2025-54386: critical 9.8, EPSS 1.27%

Traefik Client Plugin's Path Traversal Vulnerability Allows Arbitrary File Overwrite and Remote Code Execution in github.com/traefik/traefik

Action: Upgrade github.com/traefik/traefik/v2 to 2.11.28 or later.

go get github.com/traefik/traefik/v2@v2.11.28

Affected

Fixed versions

Sources

• osv: GO-2025-3835#Go/github.com/traefik/traefik/v2
• nvd: CVE-2025-54386
• https://github.com/traefik/traefik/security/advisories/GHSA-q6gg-9f92-r9wg
• https://github.com/traefik/traefik/commit/5ef853a0c53068f69a6c229a5815a0dc6e0a8800
• https://github.com/traefik/traefik/pull/11911
• https://github.com/traefik/plugin-service/pull/71
• https://github.com/traefik/plugin-service/pull/72
• https://github.com/traefik/traefik/releases/tag/v2.11.28

CVE-2025-54386 · published 2025-08-11T17:24:51Z · modified 2026-02-04T02:34:21.339712Z · JSON