CVE-2025-14727: 
NGINX Ingress Controller (NGINX Inc) vulnerability analysis and mitigation

CVE-2025-14727 is a path traversal vulnerability (CWE-22) in F5's NGINX Ingress Controller, specifically within the nginx.org/rewrite-target annotation validation mechanism. It was disclosed on December 17, 2025, and affects NGINX Ingress Controller version 5.3.0 (versions that have reached End of Technical Support are not evaluated). The vulnerability carries a CVSS v3.1 base score of 8.3 (High) and a CVSS v4.0 base score of 8.7 (High) (F5 Advisory).

The root cause is improper limitation of a pathname to a restricted directory (CWE-22) in the validation logic for the nginx.org/rewrite-target Kubernetes Ingress annotation. An attacker with low-privileged network access can craft a malicious annotation value that bypasses path validation, potentially using techniques such as URL encoding, escaped slashes, or alternate path encodings (CAPEC-64, CAPEC-78, CAPEC-79) to traverse outside the intended directory scope. No authentication beyond low-privilege access is required, and no user interaction is needed for exploitation (F5 Advisory).

Successful exploitation allows a low-privileged attacker to read sensitive files outside the intended directory scope, compromising confidentiality, and potentially modify restricted files, impacting integrity. Availability impact is rated low. In a Kubernetes environment, this could expose secrets, configuration files, or other sensitive data accessible to the NGINX Ingress Controller process, potentially enabling further lateral movement within the cluster (F5 Advisory).

F5 has released NGINX Ingress Controller version 5.3.1 to address this vulnerability; users should upgrade from 5.3.0 to 5.3.1 immediately (F5 Advisory). As interim mitigations, administrators should restrict who can create or modify Ingress resources with nginx.org/rewrite-target annotations using Kubernetes RBAC, implement strict input validation for path-related annotations, and audit existing Ingress configurations for suspicious rewrite-target values. Versions that have reached End of Technical Support (EoTS) are not evaluated and should be upgraded regardless.

The vulnerability received routine coverage from security aggregators and community feeds shortly after disclosure on December 17, 2025, including mentions on Mastodon, Bluesky, and infosec-focused newsletters (CERT.at). No notable researcher deep-dives or vendor statements beyond the official F5 advisory have been identified.