GHSA-cp28-5662-543f

There is a vulnerability in Traefik's request path sanitization. The sanitizePath entry point option, enabled by default, resolves the .. and . dot-segments and removes the duplicate slashes from the request path before routing, but it leaves a dot-segment carrying a path parameter, such as /..;x/, untouched. Traefik matches its routers and applies its middlewares on this unresolved path and forwards it unchanged. When a backend that strips path parameters (Servlet containers, Spring, ...) is shared between an unauthenticated router and a router protected by an authentication or authorization middleware, an unauthenticated attacker can send a single request such as /public/..;x/admin to reach the protected resources and bypass the middleware.

Traefik v2.11.62, v3.7.18 and v3.8.0-rc.2 resolve the .., . and empty segments carrying path parameters before the dot-segment removal, when sanitizePath is enabled (the default).