CVE-2025-66490: Path Normalization Bypass in Traefik Router + Middleware Rules

There is a potential vulnerability in Traefik managing the requests using a PathPrefix, Path or PathRegex matcher.

When Traefik is configured to route the requests to a backend using a matcher based on the path; if the request path contains an encoded restricted character from the following set (’/’, ‘', ‘Null’, ‘;’, ‘?’, ‘#’), it’s possible to target a backend, exposed using another router, by-passing the middlewares chain.

Access Control Bypass: Any endpoint intended to be blocked (e.g., admin/debug/beta APIs) can be accessed by URL-encoding slashes or other characters.

This could lead to:

• Unauthorized access to restricted endpoints
• Execution of protected internal functionality
• Potential privilege escalation
• Bypass of security policies enforced via Traefik routing rules