{"id":"CVE-2022-4886","aliases":["GHSA-gvrm-w2f9-f77q"],"title":"Ingress-nginx path sanitization can be bypassed","summary":"Ingress-nginx path sanitization can be bypassed","severity":"high","cvss":8.8,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","vendor":"ingress-nginx","product":"k8s.io/ingress-nginx","ecosystem":"go","affected":["k8s.io/ingress-nginx < 1.8.0"],"patched":["k8s.io/ingress-nginx 1.8.0"],"published":"2023-10-25","updated":"2026-08-07","source":"OSV","sourceUrl":"https://osv.dev/vulnerability/GHSA-gvrm-w2f9-f77q","references":[{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-4886"},{"url":"https://github.com/kubernetes/ingress-nginx/issues/10570"},{"url":"https://github.com/kubernetes/ingress-nginx"},{"url":"https://groups.google.com/g/kubernetes-security-announce/c/ge7u3qCwZLI"},{"url":"https://security.netapp.com/advisory/ntap-20240307-0013"},{"url":"http://www.openwall.com/lists/oss-security/2023/10/25/5"}],"tags":["osv","go"],"epss":0.01554,"epssPercentile":0.73614,"ingestedAt":"2026-08-07T19:14:17.051Z","slug":"CVE-2022-4886","body":"## Overview\n\nIngress-nginx `path` sanitization can be bypassed with `log_format` directive.\n\n## Affected packages\n\n- `k8s.io/ingress-nginx < 1.8.0`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `k8s.io/ingress-nginx 1.8.0`","depth":"twilight","depthScore":49,"depthScoreParts":{"impact":48.4,"likelihood":0.3,"exploitation":0,"ransomware":0},"changes":[]}