PT-2026-22939 · Docker · Docker Compose+2
Published
2026-03-04
·
Updated
2026-05-25
·
CVE-2025-15558
CVSS v3.1
9.8
Critical
| Vector | AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
Docker CLI versions through 29.1.5
Docker Compose versions 2.31.0 through 5.0.0
Description
The Docker CLI for Windows searches for plugin binaries in
C:ProgramDataDockercli-plugins, a directory that does not exist by default. An attacker with limited privileges can create this directory and place malicious CLI plugin binaries, such as docker-compose.exe or docker-buildx.exe, which are then executed when a user opens Docker Desktop or uses Docker CLI plugin features. If the docker CLI is run with elevated privileges, this could lead to privilege escalation. This issue impacts Windows binaries utilizing the github.com/docker/cli/cli-plugins/manager package, including Docker Compose. The vulnerability was introduced in Docker Compose version 2.31.0. The vulnerable code is within the github.com/docker/cli/cli-plugins/manager package.Recommendations
Update Docker CLI to version 29.2.0 or later.
Update Docker Compose to version 5.1.0 or later.
Fix
Uncontrolled Search Path Element
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Docker Cli
Docker Compose
Docker Desktop