certfr_avis - certfr-2025-avi-0652

CERTFR-2025-AVI-0652

Vulnerability from certfr_avis

Une vulnérabilité a été découverte dans dans le greffon "WASM Client" pour Traefik. Elle permet à un attaquant de provoquer une atteinte à l'intégrité des données.

Solutions

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

Impacted products

Vendor	Product	Description
Traefik	Traefik	Greffon "WASM Client" pour Traefik versions v3.5.x antérieures à v3.5.0
Traefik	Traefik	Greffon "WASM Client" pour Traefik versions v3.4.x antérieures à v3.4.5
Traefik	Traefik	Greffon "WASM Client" pour Traefik versions antérieures à v2.11.28

References

Title

Publication Time

Tags

Bulletin de sécurité Traefik GHSA-q6gg-9f92-r9wg

2025-08-01

vendor-advisory

Show details on source website

JSON

To clipboard

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "Greffon \"WASM Client\" pour Traefik versions v3.5.x ant\u00e9rieures \u00e0 v3.5.0",
      "product": {
        "name": "Traefik",
        "vendor": {
          "name": "Traefik",
          "scada": false
        }
      }
    },
    {
      "description": "Greffon \"WASM Client\" pour Traefik versions v3.4.x ant\u00e9rieures \u00e0 v3.4.5",
      "product": {
        "name": "Traefik",
        "vendor": {
          "name": "Traefik",
          "scada": false
        }
      }
    },
    {
      "description": "Greffon \"WASM Client\" pour Traefik versions ant\u00e9rieures \u00e0 v2.11.28",
      "product": {
        "name": "Traefik",
        "vendor": {
          "name": "Traefik",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": "",
  "content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
  "cves": [
    {
      "name": "CVE-2025-54386",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-54386"
    }
  ],
  "initial_release_date": "2025-08-04T00:00:00",
  "last_revision_date": "2025-08-04T00:00:00",
  "links": [],
  "reference": "CERTFR-2025-AVI-0652",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2025-08-04T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "Atteinte \u00e0 l\u0027int\u00e9grit\u00e9 des donn\u00e9es"
    }
  ],
  "summary": "Une vuln\u00e9rabilit\u00e9 a \u00e9t\u00e9 d\u00e9couverte dans  dans le greffon \"WASM Client\" pour Traefik. Elle permet \u00e0 un attaquant de provoquer une atteinte \u00e0 l\u0027int\u00e9grit\u00e9 des donn\u00e9es.",
  "title": "Vuln\u00e9rabilit\u00e9 dans le greffon \"WASM Client\" pour Traefik",
  "vendor_advisories": [
    {
      "published_at": "2025-08-01",
      "title": "Bulletin de s\u00e9curit\u00e9 Traefik GHSA-q6gg-9f92-r9wg",
      "url": "https://github.com/traefik/traefik/security/advisories/GHSA-q6gg-9f92-r9wg"
    }
  ]
}

CVE-2025-54386 (GCVE-0-2025-54386)

Vulnerability from cvelistv5

Published

2025-08-01 23:32

Modified

2025-08-04 15:28

Severity ?

7.3 (High) - CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:P/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L

CWE

CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CWE-30 - Path Traversal: 'dir..filename'

Summary

Traefik is an HTTP reverse proxy and load balancer. In versions 2.11.27 and below, 3.0.0 through 3.4.4 and 3.5.0-rc1, a path traversal vulnerability was discovered in WASM Traefik’s plugin installation mechanism. By supplying a maliciously crafted ZIP archive containing file paths with ../ sequences, an attacker can overwrite arbitrary files on the system outside of the intended plugin directory. This can lead to remote code execution (RCE), privilege escalation, persistence, or denial of service. This is fixed in versions 2.11.28, 3.4.5 and 3.5.0.

References

URL

Tags

	https://github.com/traefik/traefik/security/advisories/GHSA-q6gg-9f92-r9wg	x_refsource_CONFIRM
	https://github.com/traefik/plugin-service/pull/71	x_refsource_MISC
	https://github.com/traefik/plugin-service/pull/72	x_refsource_MISC
	https://github.com/traefik/traefik/pull/11911	x_refsource_MISC
	https://github.com/traefik/traefik/commit/5ef853a0c53068f69a6c229a5815a0dc6e0a8800	x_refsource_MISC
	https://github.com/traefik/traefik/releases/tag/v2.11.28	x_refsource_MISC

Impacted products

	Vendor	Product	Version
	traefik	traefik	Version: <= 2.11.27, < 2.11.28 Version: <= 3.0.0, < 3.4.5 Version: >= 3.5.0-rc1, < 3.5.0-rc2

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-54386",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-08-04T15:27:58.318834Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-08-04T15:28:06.189Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "traefik",
          "vendor": "traefik",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c= 2.11.27, \u003c 2.11.28"
            },
            {
              "status": "affected",
              "version": "\u003c= 3.0.0, \u003c 3.4.5"
            },
            {
              "status": "affected",
              "version": "\u003e= 3.5.0-rc1, \u003c 3.5.0-rc2"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Traefik is an HTTP reverse proxy and load balancer. In versions 2.11.27 and below, 3.0.0 through 3.4.4 and 3.5.0-rc1, a path traversal vulnerability was discovered in WASM Traefik\u2019s plugin installation mechanism. By supplying a maliciously crafted ZIP archive containing file paths with ../ sequences, an attacker can overwrite arbitrary files on the system outside of the intended plugin directory. This can lead to remote code execution (RCE), privilege escalation, persistence, or denial of service. This is fixed in versions 2.11.28, 3.4.5 and 3.5.0."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "HIGH",
            "attackRequirements": "PRESENT",
            "attackVector": "NETWORK",
            "baseScore": 7.3,
            "baseSeverity": "HIGH",
            "privilegesRequired": "HIGH",
            "subAvailabilityImpact": "LOW",
            "subConfidentialityImpact": "LOW",
            "subIntegrityImpact": "LOW",
            "userInteraction": "PASSIVE",
            "vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:P/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-22",
              "description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-30",
              "description": "CWE-30: Path Traversal: \u0027dir..filename\u0027",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-08-01T23:32:21.747Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/traefik/traefik/security/advisories/GHSA-q6gg-9f92-r9wg",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/traefik/traefik/security/advisories/GHSA-q6gg-9f92-r9wg"
        },
        {
          "name": "https://github.com/traefik/plugin-service/pull/71",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/traefik/plugin-service/pull/71"
        },
        {
          "name": "https://github.com/traefik/plugin-service/pull/72",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/traefik/plugin-service/pull/72"
        },
        {
          "name": "https://github.com/traefik/traefik/pull/11911",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/traefik/traefik/pull/11911"
        },
        {
          "name": "https://github.com/traefik/traefik/commit/5ef853a0c53068f69a6c229a5815a0dc6e0a8800",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/traefik/traefik/commit/5ef853a0c53068f69a6c229a5815a0dc6e0a8800"
        },
        {
          "name": "https://github.com/traefik/traefik/releases/tag/v2.11.28",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/traefik/traefik/releases/tag/v2.11.28"
        }
      ],
      "source": {
        "advisory": "GHSA-q6gg-9f92-r9wg",
        "discovery": "UNKNOWN"
      },
      "title": "Traefik\u0027s Client Plugin is Vulnerable to Path Traversal, Arbitrary File Overwrites and Remote Code Execution"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2025-54386",
    "datePublished": "2025-08-01T23:32:21.747Z",
    "dateReserved": "2025-07-21T16:12:20.734Z",
    "dateUpdated": "2025-08-04T15:28:06.189Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
Confirmed: The vulnerability is confirmed from an analyst perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
Patched: This vulnerability was successfully patched by the user reporting the sighting.
Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
Not confirmed: The user expresses doubt about the veracity of the vulnerability.
Not patched: This vulnerability was not successfully patched by the user reporting the sighting.

Action not permitted

CERTFR-2025-AVI-0652

Vulnerability from certfr_avis

Solutions

CVE-2025-54386 (GCVE-0-2025-54386)

Vulnerability from cvelistv5

Tags

Sightings

Nomenclature