Docker CLI vulnerabilities

2 known vulnerabilities in Docker CLI from Docker. 2 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 7.1 High severity

  go-archive: Improper Link Resolution Before File Access

  CVE-2026-17106Aug 18, 2026Moby

  The tar extraction routines in moby/go-archive (Unpack, UnpackLayer, Untar/UntarUncompressed, and the ApplyLayer helpers) do not confine filesystem operations to the destination directory. The extractor decides where each archive entry lands using lexical stri

• 8.0 High severity

  Docker CLI: Uncontrolled Search Path Element

  CVE-2025-15558Mar 4, 2026Docker

  Docker CLI for Windows searches for plugin binaries in C:\ProgramData\Docker\cli-plugins, a directory that does not exist by default. A low-privileged attacker can create this directory and place malicious CLI plugin binaries (docker-compose.exe, docker-buildx