1 matches found
Traefik: Rootless HTTP/1 request-target routes as "/" but is forwarded verbatim, bypassing path-scoped routing, middleware guards and access logging
Summary Traefik accepts an HTTP/1.x request whose request-target is in rootless / opaque form for example GET http:http://internal-vhost/admin HTTP/1.1. Go parses this into URL.Opaque with an empty URL.Path, so Traefik evaluates all routing, path-sanitization, middleware and access-log decisions...
8.8CVSS
SaveExploits0References7Affected Software2
20