CVE-2025-15558 Docker Desktop Docker Plugins Uncontrolled Search Path Element Local Privilege Escalation Vulnerability
A local attacker can escalate privileges by placing malicious plugins in a specific Windows directory that Docker CLI searches for execution.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2025-15558?
CVE-2025-15558 is a high-severity vulnerability in Docker Compose, published on 4 Mar 2026. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.
Official description
Docker CLI for Windows searches for plugin binaries in C:\ProgramData\Docker\cli-plugins, a directory that does not exist by default. A low-privileged attacker can create this directory and place malicious CLI plugin binaries (docker-compose.exe, docker-buildx.exe, etc.) that are executed when a victim user opens Docker Desktop or invokes Docker CLI plugin features, and allow privilege-escalation if the docker CLI is executed as a privileged user.
This issue affects Docker CLI: through 29.1.5 and Windows binaries acting as a CLI-plugin manager using the github.com/docker/cli/cli-plugins/manager https://pkg.go.dev/github.com/docker/[email protected]+incompatible/cli-plugins/manager package, such as Docker Compose.
This issue does not impact non-Windows binaries, and projects not using the plugin-manager code.
Weakness: CWE-427
Which versions are affected by CVE-2025-15558?
7 open source packages ship an affected version, including github.com/docker/compose, docker-cli and github.com/docker/cli. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
github.com/docker/compose Go | All versions | None |
docker-cli Bitnami | All versions | 29.2.1 |
github.com/docker/cli Go | All versions | 29.2.0+incompatible |
github.com/docker/cli Go | From 19.03.0 | 29.2.0 |
github.com/docker/cli Go | From 19.03.0 | 29.2.0 |
github.com/docker/compose/v2 Go | From 2.31.0 | None |
1 more packages
github.com/docker/compose/v5 Go | All versions | 5.1.0 |
Linux distribution packages (1)
skaffold openSUSE:Tumbleweed | All versions | 2.18.0-1.1 |
Products include Docker Command Line Interface.
How do I fix CVE-2025-15558?
Apply the vendor's patch.
Is CVE-2025-15558 being exploited?
There is no known exploitation of CVE-2025-15558 in the wild and no public exploit code.
Other vulnerabilities in Docker Compose
Sources
Also known as BIT-docker-cli-2025-15558, CLEANSTART-2026-CY83720, CLEANSTART-2026-JJ50819, CLEANSTART-2026-NT42167, CLEANSTART-2026-WJ82111, CLEANSTART-2026-WR28869 and 274 more.