Vulnerability in Docker Command Line Interface
CVE-2025-15558
Docker CLI for Windows searches for plugin binaries in C:\ProgramData\Docker\cli-plugins, a directory that does not exist by default. A low-privileged attacker can create this directory and place malicious CLI plugin binaries (docker-compose.exe, docker-buildx.exe, etc.) that are executed when a victim user opens Docker Desktop or invokes Docker CLI plugin features, and allow privilege-escalation if the docker CLI is executed as a privileged user. This issue affects Docker CLI: through 29.1.5 and Windows binaries acting as a CLI-plugin manager using the github.com/docker/cli/cli-plugins/manager https://pkg.go.dev/github.com/docker/cli@v29.1.5+incompatible/cli-plugins/manager package, such as Docker Compose. This issue does not impact non-Windows binaries, and projects not using the plugin-manager code.
EPSS: 0.005 (38.2th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 8.0 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H.
Affected products
- Docker Command_line_interface
- Docker Compose — versions 5.1.0
- Docker Cli — versions 29.2.0
- Microsoft Windows
Weakness classification (CWE)
References
- security@docker.com (Release Notes)
- security@docker.com (Not Applicable, third-party-advisory)
- security@docker.com (Patch, patch, Issue Tracking)
- 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
- 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
- 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
Frequently asked questions
- What is CVE-2025-15558?
- CVE-2025-15558 is a high-severity vulnerability in Docker Command Line Interface, classified under Uncontrolled Search Path Element. CVSS score: 8.0/10. Published 2026-03-04.
- How severe is CVE-2025-15558?
- High severity. CVSS v3 base score is 8.0 out of 10.