{"action":"Upgrade github.com/traefik/traefik/v2 to 2.11.28 or later.","affected":[{"fixed":"2.11.28","introduced":"0"}],"component":"github.com/traefik/traefik/v2","cve_ids":["CVE-2025-54386"],"ecosystem":"Go","epss":0.01269,"exploited":false,"fixed_versions":["2.11.28"],"ghsa_id":"GHSA-q6gg-9f92-r9wg","id":"tcs_01M5KG9M22CJPP8363N6JS8Y8X","modified_at":"2026-02-04T02:34:21.339712Z","published_at":"2025-08-11T17:24:51Z","references":["https://osv.dev/vulnerability/GO-2025-3835","https://github.com/traefik/traefik/security/advisories/GHSA-q6gg-9f92-r9wg","https://nvd.nist.gov/vuln/detail/CVE-2025-54386","https://github.com/traefik/traefik/commit/5ef853a0c53068f69a6c229a5815a0dc6e0a8800","https://github.com/traefik/traefik/pull/11911","https://github.com/traefik/plugin-service/pull/71","https://github.com/traefik/plugin-service/pull/72","https://github.com/traefik/traefik/releases/tag/v2.11.28"],"severity":{"label":"critical","score":9.8},"sources":[{"source":"osv","source_id":"GO-2025-3835#Go/github.com/traefik/traefik/v2","url":"https://osv.dev/vulnerability/GO-2025-3835"},{"source":"nvd","source_id":"CVE-2025-54386","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-54386"}],"summary":"Traefik Client Plugin's Path Traversal Vulnerability Allows Arbitrary File Overwrite and Remote Code Execution in github.com/traefik/traefik"}