CVE-2022-1798: google llc kubevirt Improper Input Validation
CVSS: 8.7v3.1HighModified
AliasesGHSA-cvx8-ppmc-78hmGHSA-qv98-3369-g364GO-2022-1000
Published 15-09-2022Last modified 21-04-2025
Vulnerability summary
CVE-2022-1798 is a high (CVSS 8.7) Improper Input Validation vulnerability in google llc kubevirt. EPSS estimates a 0.38% chance of exploitation in the next 30 days, higher than 30% of scored vulnerabilities. 1 public exploit is recorded.
CVSS score
8.7/10
010
High · v3.1 (CVE.org)EPSS score
0.38%
0%100%
Low · 0.00 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits1github
Advisory lineage
Upstream 0 · Downstream 2 · Related 2Timeline
- 15-09-2022PublishedVulnerability first disclosed.
- 21-04-2025Last modifiedVulnerability information updated.
Description
A path traversal vulnerability in KubeVirt versions up to 0.56 (and 0.55.1) on all platforms allows a user able to configure the kubevirt to read arbitrary files on the host filesystem which are publicly readable or which are readable for UID 107 or GID 107. /proc/self/<> is not accessible.
CVSS metrics
3 scores · 3 sources · 1 versionHigh 8.7Preferred score · CVE.org (CNA)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:HSources3 sources · 6.5–8.7
- OSV · GoEcosystem advisory · calculated6.5MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:NDiffers
- NVDNIST6.5MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:NDiffers
EPSS trend
Probability
0.38%
Chance of exploitation in the next 30 days
Percentile
30%
Versus all other CVEs
30-day change
0.00 pp
From 0.38% on 19-09-2026
19-09-202619-10-2026
EPSS score0.38%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
1 foundKubevirt
Maturity: poc
Weaknesses
CWE · root cause- CWE-20Improper Input ValidationThe product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.
- CWE-22Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
Affected systems
Google llc1 product
- kubevirt≥ unspecified, < 0.55.1 | ≥ unspecified, < 0.56.0
Kubevirt1 product
- kubevirt≥ 0.20.0, < 0.55.1
Kubevirt.io1 product
- kubevirt≥ 0.20.0, < 0.55.1
3 vendors · 3 products
References
6 links- github.com/kubevirt/kubevirt/security/advisories/GHSA-qv98-3369-g364X Refsource CONFIRMWEBAdvisoryExploitMitigationPatchThird Party Advisory
- github.com/kubevirt/kubevirtPACKAGE