CVE-2025-62725

Published Oct 27, 2025

Last updated 8 hours ago

Overview

AI description

Automated description summarized from trusted sources.

CVE-2025-62725 is a path traversal vulnerability in Docker Compose that allows attackers to write arbitrary files on the host system. This flaw exists because Docker Compose trusts path information embedded in remote OCI compose artifacts. When processing OCI layers, Compose uses annotations to determine where to write files, but it fails to properly validate these paths. An attacker can craft malicious annotations with path traversal sequences to escape the intended cache directory and write files to arbitrary locations where the Compose process has write permissions. This can be exploited by tricking a user into referencing a malicious remote artifact, even through read-only commands like `docker compose config` or `docker compose ps`. A successful exploit could lead to complete system compromise, potentially by injecting an SSH public key into the target system's authorized_keys file.

Description: Docker Compose trusts the path information embedded in remote OCI compose artifacts. When a layer includes the annotations com.docker.compose.extends or com.docker.compose.envfile, Compose joins the attacker‑supplied value from com.docker.compose.file/com.docker.compose.envfile with its local cache directory and writes the file there. This affects any platform or workflow that resolves remote OCI compose artifacts, Docker Desktop, standalone Compose binaries on Linux, CI/CD runners, cloud dev environments is affected. An attacker can escape the cache directory and overwrite arbitrary files on the machine running docker compose, even if the user only runs read‑only commands such as docker compose config or docker compose ps. This issue is fixed in v2.40.2.
Source: security-advisories@github.com
NVD status: Awaiting Analysis

Risk scores

CVSS 4.0

Type: Secondary
Base score: 8.9
Impact score: -
Exploitability score: -
Vector string: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Severity: HIGH

Weaknesses

security-advisories@github.com: CWE-22

Hype score is a measure of social media activity compared against trending CVEs from the past 12 months. Max score 100.

Hype score: 39

References