CVE-2025-15558
Description
Docker CLI for Windows searches for plugin binaries in C:\ProgramData\Docker\cli-plugins, a directory that does not exist by default. A low-privileged attacker can create this directory and place malicious CLI plugin binaries (docker-compose.exe, docker-buildx.exe, etc.) that are executed when a victim user opens Docker Desktop or invokes Docker CLI plugin features, and allow privilege-escalation if the docker CLI is executed as a privileged user. This issue affects Docker CLI: through 29.1.5 and Windows binaries acting as a CLI-plugin manager using the github.com/docker/cli/cli-plugins/manager https://pkg.go.dev/github.com/docker/[email protected]+incompatible/cli-plugins/manager package, such as Docker Compose. This issue does not impact non-Windows binaries, and projects not using the plugin-manager code.
How to fix
- github.com/docker/cli29.2.0, 29.2.0+incompatible or later
- github.com/docker/compose/v55.1.0 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| github.com/docker/cliGo | 19.03.0 ≤ v < 29.2.0, v < 29.2.0+incompatible | 29.2.0, 29.2.0+incompatible |
| docker command_line_interface | v ≤ 29.1.5 | — |
| github.com/docker/composeGo | No range specified | — |
| github.com/docker/compose/v2Go | 2.31.0 ≤ v | — |
| github.com/docker/compose/v5Go | v < 5.1.0 | 5.1.0 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.