CVE-2022-4886 Ingress-nginx `path` sanitization can be bypassed with `log_format` directive

Description

Ingress-nginx `path` sanitization can be bypassed with `log_format` directive.

Affected products and versions

Product	Affected versions	Fixed in
ingress-nginx 1.8	earliest → < 1.8.0	1.8.0

Other CVEs of ingress-nginx

The 18 CVEs of ingress-nginx →

CVE-2026-116472 ingress-nginx mirror-target self-DOS 2.7 Low CVE-2026-4342 A security issue was discovered in ingress-nginx where a combination of Ingress annotations can be used to inject… 8.8 High CVE-2026-3288 A security issue was discovered in ingress-nginx where the `nginx.ingress.kubernetes.io/rewrite-target` Ingress… 8.8 High CVE-2025-15566 A security issue was discovered in ingress-nginx where the `nginx.ingress.kubernetes.io/auth-proxy-set-headers`… 8.8 High