GO-2026-4610
Docker CLI Plugins: Uncontrolled Search Path Element Leads to Local Privilege Escalation on Windows in github.com/docker/cli
At a glance
- Published
- Updated
- CVE
- CVE-2025-15558
- Aliases
- BIT-docker-cli-2025-15558, GHSA-p436-gjf2-799p
Description
Docker CLI Plugins: Uncontrolled Search Path Element Leads to Local Privilege Escalation on Windows in github.com/docker/cli
Affected packages
| Package | Versions |
|---|---|
| Go · github.com/docker/cli | introduced 0, fixed 29.2.0+incompatible |
| Go · github.com/docker/compose | introduced 0 |
| Go · github.com/docker/compose/v2 | introduced 2.31.0 |
| Go · github.com/docker/compose/v5 | introduced 0, fixed 5.1.0 |
References
- https://github.com/docker/cli/security/advisories/GHSA-p436-gjf2-799p ADVISORY
- https://github.com/docker/cli/commit/13759330b1f7e7cb0d67047ea42c5482548ba7fa FIX
- https://github.com/docker/cli/pull/6713 FIX
- https://github.com/docker/compose/pull/12300 FIX
- https://docs.docker.com/desktop/release-notes WEB
- https://www.zerodayinitiative.com/advisories/ZDI-CAN-28304 WEB
Sources
| Source | Licence |
|---|---|
| OSV.dev | CC-BY 4.0 — Go Vulnerability Database |