CVE-2025-47952

score

<0.1

cvss

9.1

epss

0.9%

published

2025-05-30

kev added

—

first seen

2026-10-21

Traefik < 2.11.25 and < 3.4.1 contains a broken access control vulnerability caused by improper handling of URL encoded strings in path matchers, letting attackers bypass middleware chains and target unintended backends, exploit requires crafted URL with encoded path.