Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Traefik is an HTTP reverse proxy and load balancer. In versions 2.11.27 and below, 3.0.0 through 3.4.4 and 3.5.0-rc1, a path traversal vulnerability was discovered in WASM Traefik’s plugin installation mechanism. By supplying a maliciously crafted ZIP archive containing file paths with ../ sequences, an attacker can overwrite arbitrary files on the system outside of the intended plugin directory. This can lead to remote code execution (RCE), privilege escalation, persistence, or denial of service. This is fixed in versions 2.11.28, 3.4.5 and 3.5.0.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
AVAILABLE
Momentum
NONE
If you run products in this scope, you should treat this CVE as relevant to your environment.
1 version affected across 1 product
CRITICAL PATCH: openSUSE rolls out fix for high-severity OpenSSL flaw in Traefik 2.11.35 (CVE-2025-54386). Read more: 👉 https://tinyurl.com/yvhnndnz #Security https://t.co/vNu4Em1xmV
Post summary
openSUSE has released a critical patch for CVE‑2025‑54386, a high‑severity OpenSSL flaw impacting Traefik 2.11.35.
4 of 4 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | traefik | traefik | - | - | - |
| App | traefik | traefik | 3.5.0 | - | - |
| App | traefik | traefik | 3.5.0 | - | - |
| App | traefik | traefik | 3.5.0 | - | - |