Compose vulnerabilities

2 known vulnerabilities in Compose from Docker. 2 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 8.0 High severity

  Docker CLI: Uncontrolled Search Path Element

  CVE-2025-15558Mar 4, 2026Docker

  Docker CLI for Windows searches for plugin binaries in C:\ProgramData\Docker\cli-plugins, a directory that does not exist by default. A low-privileged attacker can create this directory and place malicious CLI plugin binaries (docker-compose.exe, docker-buildx

• 8.9 High severity

  compose: Improper Limitation of a Pathname to a Restricted Directory

  CVE-2025-62725Oct 27, 2025DockerEPSS 15.8%

  Docker Compose trusts the path information embedded in remote OCI compose artifacts. When a layer includes the annotations com.docker.compose.extends or com.docker.compose.envfile, Compose joins the attacker‑supplied value from com.docker.compose.file/com.dock