rewindex

RewindexCVEsDocker

CVE-2025-15558: Docker Desktop Docker Plugins Uncontrolled Search Path Element Local Privilege Escalation Vulnerability

High · CVSS 7.3 (CVSS 3.1)EPSS 0.50%, 43th percentilePublished Updated Assigner: Docker

Description

Docker CLI for Windows searches for plugin binaries in C:\ProgramData\Docker\cli-plugins, a directory that does not exist by default. A low-privileged attacker can create this directory and place malicious CLI plugin binaries (docker-compose.exe, docker-buildx.exe, etc.) that are executed when a victim user opens Docker Desktop or invokes Docker CLI plugin features, and allow privilege-escalation if the docker CLI is executed as a privileged user. This issue affects Docker CLI: through 29.1.5 and Windows binaries acting as a CLI-plugin manager using the github.com/docker/cli/cli-plugins/manager https://pkg.go.dev/github.com/docker/cli@v29.1.5+incompatible/cli-plugins/manager  package, such as Docker Compose. This issue does not impact non-Windows binaries, and projects not using the plugin-manager code.

Vector CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H · CWE-427

Tracked companies

Docker

Mapped from the CVE’s affected-product data, NVD CPE matches, vendor advisories or package feeds. A mapping means the vendor’s software is named, not that its hosted service was exposed.

Status incidents that name it

No tracked status incident names this CVE.

Affected vendors and products

Docker: ComposeDocker: Docker CLIRed Hat: Assisted Installer for Red Hat OpenShift Container Platform 2Red Hat: Gatekeeper 3Red Hat: Kernel Module Management Operator for Red Hat OpenshiftRed Hat: Multicluster Engine for KubernetesRed Hat: Multicluster Global HubRed Hat: Red Hat Advanced Cluster Management for Kubernetes 2Red Hat: Red Hat Advanced Cluster Security 4Red Hat: Red Hat OpenShift AI (RHOAI)Red Hat: Red Hat OpenShift Container Platform 4Red Hat: Red Hat OpenShift Virtualization 4

References

All CVEsMarkdownJSON