CVE-2025-66490: 
NixOS vulnerability analysis and mitigation

CVE-2025-66490 is a path normalization bypass vulnerability in Traefik's router and middleware rules, allowing unauthenticated attackers to circumvent access-control middleware by submitting URL-encoded restricted characters in request paths. It affects all Traefik versions up to and including v1.7.34 (no patch available for v1.x), v2.x before 2.11.32, and v3.x before 3.6.3. The vulnerability was discovered during PwnSec CTF 2025 and publicly disclosed on December 8, 2025. It carries a CVSS v3.1 score of 6.5 (Medium) and a CVSS v4.0 score of 6.9 (Medium) (Github Advisory, Traefik Advisory).

The root cause is an interpretation conflict (CWE-436) between Traefik's path-matching logic and its request forwarding behavior. Traefik evaluates router rules (PathPrefix, Path, PathRegex matchers) against the raw, un-decoded request path, but forwards the decoded path to the backend service. When a request path contains percent-encoded restricted characters such as %2F (/), %5C (\), %00 (Null), %3B (;), %3F (?), or %23 (#), the encoded form does not match the intended router rule, so the associated middleware chain (e.g., a blocking or authentication middleware) is skipped entirely. The request is then decoded and forwarded to the backend, effectively bypassing the security controls. A concrete PoC demonstrates that a request to /%2freport_note bypasses a PathPrefix('/report_note') rule with a blocking middleware, reaching the backend unimpeded (Github Advisory, Traefik Advisory).

Successful exploitation allows an unauthenticated remote attacker to bypass any middleware enforced on path-based routes, including authentication, authorization, rate-limiting, or blocking rules. Attackers can gain unauthorized access to restricted endpoints such as admin panels, internal APIs, or debug interfaces that are intended to be protected by Traefik routing rules. This can lead to unauthorized execution of protected functionality, exposure of sensitive data, and potential privilege escalation depending on what the bypassed backend exposes (Github Advisory, Traefik Advisory).

A proof-of-concept exploit was publicly disclosed as part of the original advisory, discovered during PwnSec CTF 2025 by researcher ShadoooooW of team @0xL4ugh. The vulnerability requires no authentication, no special privileges, and no user interaction, making it trivially exploitable by any network-accessible attacker. The EPSS score is approximately 0.013–0.018%, indicating low current exploitation probability. There is no evidence of active in-the-wild exploitation at this time, and the vulnerability is not listed in the CISA KEV catalog. HackTheBox has also incorporated this vulnerability into dedicated lab content (Github Advisory, Traefik Advisory).

1. Reconnaissance: Identify internet-facing Traefik instances (v2.x < 2.11.32 or v3.x < 3.6.3) using tools like Shodan or Censys, or by inspecting HTTP response headers (e.g., X-Powered-By: Traefik) to confirm the proxy in use.
2. Map routing rules: Probe the target application to identify path-based routes that are protected by middleware (e.g., /admin/, /internal/, /report_note). These are typically documented or discoverable via error responses or application behavior.
3. Craft encoded request: Construct an HTTP request where the restricted path segment is percent-encoded. For example, to bypass a PathPrefix('/admin/') rule, send a request to /%61dmin/ or /admin%2F (encoding the slash). To bypass /report_note, send POST /%2freport_note HTTP/1.1.
4. Send the request: Deliver the crafted request to the Traefik entry point. Traefik's router evaluates the raw encoded path, fails to match the protected route rule, and skips the associated middleware chain.
5. Access protected backend: The decoded path is forwarded to the backend service, granting access to the restricted endpoint without any middleware (authentication, blocking, etc.) being applied (Github Advisory, Traefik Advisory).

• Network: HTTP requests to Traefik entry points containing percent-encoded path characters such as %2F, %5C, %00, %3B, %3F, or %23 in the URL path, particularly targeting paths that correspond to known protected routes (e.g., /%2fadmin/, /%2freport_note).
• Logs: Traefik access logs showing requests with encoded characters in the path field that result in successful 2xx responses to routes that should be protected by middleware; absence of expected middleware log entries (e.g., authentication or blocking middleware) for requests to sensitive paths.
• Logs: Discrepancy between the raw request path logged by Traefik (containing encoded characters) and the decoded path received by the backend service, indicating a normalization bypass occurred.
• Application Logs: Backend service logs showing access to restricted endpoints (e.g., /admin/, /internal/) from unexpected source IPs or at unusual times, without corresponding authentication events.

Traefik has released patched versions that reject suspicious encoded characters at the server level: v2.11.32 for the 2.x branch and v3.6.3/v3.6.4 for the 3.x branch. Note that v1.x (≤ 1.7.34) has no available patch. Upgrading is the primary recommended remediation; note that the fix is a breaking change and the migration guide should be reviewed before upgrading. As a workaround where immediate upgrade is not possible, implement additional network-level access controls (e.g., WAF rules rejecting percent-encoded path separators) and validate request paths upstream of Traefik. Strict path matching rules and additional input validation at the backend layer can reduce exposure (Traefik v2.11.32 Release, Traefik v3.6.4 Release, Traefik Community).

The Traefik maintainer team (nmengin) published the advisory on December 8, 2025, and released patched versions promptly. The Traefik community forum posted a security update announcement covering both CVE-2025-66490 and the related CVE-2025-66491 (Traefik Community). The vulnerability was originally discovered during PwnSec CTF 2025 and credited to researcher ShadoooooW of team @0xL4ugh, reflecting the growing role of CTF competitions in real-world vulnerability discovery. HackTheBox subsequently incorporated the vulnerability into dedicated lab content, indicating community interest in the technique.