The vulnerability in Traefik's ReplacePathRegex middleware arises from insufficient validation of replaced paths when using regex patterns that capture user-controlled segments without mandatory path separators. An attacker can craft requests that produce un-normalized paths (e.g., '/../admin') which backend systems normalize to protected routes, effectively bypassing authentication middleware. This affects Traefik versions <=2.11.51, >=3.6.0 <=3.6.22, and >=3.7.0 <=3.7.6. The flaw is addressed in versions 2.11.52, 3.6.23, and 3.7.7.

An unauthenticated remote attacker can bypass authentication controls by exploiting path traversal in the ReplacePathRegex middleware, potentially gaining unauthorized access to protected backend routes. This can lead to unauthorized access to sensitive resources or administrative interfaces depending on backend configuration.

Upgrade Traefik to version 2.11.52, 3.6.23, or 3.7.7 or later where this vulnerability is fixed. Until patched, avoid using ReplacePathRegex middleware configurations that capture user-controlled path segments without mandatory path separators. Patch status is confirmed by the vendor advisory.