What is CVE-2015-3627?

CVE-2015-3627 is a vulnerability in Docker, classified under Improper Link Resolution Before File Access. Published 2015-05-18.

Is CVE-2015-3627 known to be exploited?

3 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.

Vulnerability in Docker

CVE-2015-3627

Libcontainer and Docker Engine before 1.6.1 opens the file-descriptor passed to the pid-1 process before performing the chroot, which allows local users to gain privileges via a symlink attack in an image.

Published 2015-05-18 · last modified 2026-06-17.

CVSS v2 metric

CVSS v2 base score 7.2 (High). Vector: AV:L/AC:L/Au:N/C:C/I:C/A:C. This CVE predates CVSS v3 and has no v3 score from NVD.

EPSS exploit prediction

EPSS: 0.006 (47.0th percentile), scored 2026-09-29.

Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 47th percentile — 47.0% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.

EPSS over last 30 days · oldest: 0.006 · newest: 0.006 · change: 0.000

Affected products

Weakness classification (CWE)

CWE-59 — Improper Link Resolution Before File Access

Public proof-of-concept exploits

References

groups.google.com/forum/
seclists.org/fulldisclosure/2015/May/28 (mailing-list)
lists.opensuse.org/opensuse-updates/2015-05/msg00023.html (vendor-advisory)
packetstormsecurity.com/files/131835/Docker-Privilege-Escalation-Information-Di…

Frequently asked questions

What is CVE-2015-3627?: CVE-2015-3627 is a vulnerability in Docker, classified under Improper Link Resolution Before File Access. Published 2015-05-18.
Is CVE-2015-3627 known to be exploited?: 3 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.