Vulnerability · Published Mar 4, 2026 · Assigned by Docker
CVE-2025-15558Docker Desktop Docker Plugins Uncontrolled Search Path Element Local Privilege Escalation Vulnerability
High 7.3
In plain English
A high-severity uncontrolled search path in Compose from Docker. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 46% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
Docker CLI for Windows searches for plugin binaries in C:\ProgramData\Docker\cli-plugins, a directory that does not exist by default. A low-privileged attacker can create this directory and place malicious CLI plugin binaries (docker-compose.exe, docker-buildx.exe, etc.) that are executed when a victim user opens Docker Desktop or invokes Docker CLI plugin features, and allow privilege-escalation if the docker CLI is executed as a privileged user. This issue affects Docker CLI: through 29.1.5 and Windows binaries acting as a CLI-plugin manager using the github.com/docker/cli/cli-plugins/manager https://pkg.go.dev/github.com/docker/cli@v29.1.5+incompatible/cli-plugins/manager package, such as Docker Compose. This issue does not impact non-Windows binaries, and projects not using the plugin-manager code.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Go | github.com/docker/cli | 29.2.0 | GHSA-p436-gjf2-799p |
| Go | github.com/docker/cli | 29.2.0+incompatible | GO-2026-4610 |
| Go | github.com/docker/compose | no fix listed | GO-2026-4610 |
| Go | github.com/docker/compose/v2 | no fix listed | GO-2026-4610 |
| Go | github.com/docker/compose/v5 | 5.1.0 | GO-2026-4610 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Docker | Docker CLI | see references |
| Docker | Compose | see references |
Weakness: CWE-427 · Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
References
- https://docs.docker.com/desktop/release-notes/
- https://www.zerodayinitiative.com/advisories/ZDI-CAN-28304/ third-party-advisory
- https://github.com/docker/cli/pull/6713 patch
- https://access.redhat.com/security/cve/CVE-2025-15558 vdb-entry, x_refsource_REDHAT
- RHBZ#2444574 issue-tracking, x_refsource_REDHAT
- https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-15558.json x_sadp-csaf-vex