CVE-2025-15558

Docker CLI Plugins: Uncontrolled Search Path Element Leads to Local Privilege Escalation on Windows

Docker CLI for Windows searches for plugin binaries in C:\ProgramData\Docker\cli-plugins, a directory that does not exist by default. A low-privileged attacker can create this directory and place malicious CLI plugin binaries (docker-compose.exe, docker-buildx.exe, etc.) that are executed when a victim user opens Docker Desktop or invokes Docker CLI plugin features, and allow privilege-escalation if the docker CLI is executed as a privileged user.

This issue affects Docker CLI through v29.1.5 (fixed in v29.2.0). It impacts Windows binaries acting as a CLI plugin manager via the github.com/docker/cli/cli-plugins/manager package, which is consumed by downstream projects such as Docker Compose.

Docker Compose became affected starting in v2.31.0, when it incorporated the relevant CLI plugin manager code (see https://github.com/docker/compose/pull/12300), and is fixed in v5.1.0.

This issue does not impact non-Windows binaries or projects that do not use the plugin manager code.

Kodem intelligence

Already deployed Kodem?

1. What is CVE-2025-15558? CVE-2025-15558 is a high-severity security vulnerability in github.com/docker/cli (go), affecting versions >= 19.03.0, < 29.2.0. It is fixed in 29.2.0.
2. Which versions of github.com/docker/cli are affected by CVE-2025-15558? github.com/docker/cli (go) versions >= 19.03.0, < 29.2.0 is affected.
3. Is there a fix for CVE-2025-15558? Yes. CVE-2025-15558 is fixed in 29.2.0. Upgrade to this version or later.
4. Is CVE-2025-15558 exploitable, and should I be worried? Whether CVE-2025-15558 is exploitable in your environment depends on whether the vulnerable code is present and reachable. A CVSS score is a worst-case rating; it does not account for your specific deployment, configuration, or usage patterns. Kodem, an Intelligent Application Security platform, uses runtime intelligence to show which vulnerabilities actually execute in production, so you can focus on the ones that represent real risk. Get a demo
5. What actually determines whether CVE-2025-15558 is exploitable, and how bad it is? Exploitability and impact are not fixed properties of a CVE. They depend on runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A high CVSS score on a dependency that never runs is not the same as real risk. Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter.
6. How do I fix CVE-2025-15558? Upgrade github.com/docker/cli to 29.2.0 or later.

Other vulnerabilities in github.com/docker/cli