CVE-2025-15558

🗓️ 04 Mar 2026 16:14:32Reported by DockerType

cve🔗 web.nvd.nist.gov📰️ 1 Media mentions👁 41 Views🌐 WEB

Uncontrolled search path in Windows Docker Desktop plugins enables local privilege escalation.

Reporter	Title	Published	Views	Family All 448
IBM Security Bulletins	Security Bulletin: IBM Planning Analytics Cartridge has addressed a security vulnerability in Docker CLI (CVE-2025-15558)	13 Apr 202618:45	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities affect Data Virtualization on IBM Software Hub (April 2026 - Part 1 of 2)	1 May 202605:38	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple Vulnerabilities in watsonx.data	22 Jun 202614:32	–	ibm
Chainguard	CVE-2025-15558 vulnerabilities	6 Mar 202613:39	–	cgr
Circl	CVE-2025-15558	5 Mar 202607:40	–	circl
CNNVD	Docker CLI 安全漏洞	4 Mar 202600:00	–	cnnvd
Cvelist	CVE-2025-15558 Docker Desktop Docker Plugins Uncontrolled Search Path Element Local Privilege Escalation Vulnerability	4 Mar 202616:14	–	cvelist
Tenable Nessus	Docker Desktop < 4.64.0 CLI Plugin Directory Privilege Escalation (CVE-2025-15558)	12 Mar 202600:00	–	nessus
EUVD	EUVD-2025-208275	5 Mar 202600:10	–	euvd
Github Security Blog	Docker CLI Plugins: Uncontrolled Search Path Element Leads to Local Privilege Escalation on Windows	5 Mar 202600:10	–	github

NVD

Node

docker command_line_interfaceRange≤29.1.5

AND

microsoft windowsMatch-

[
  {
    "defaultStatus": "affected",
    "platforms": [
      "Windows"
    ],
    "product": "Docker CLI",
    "vendor": "Docker",
    "versions": [
      {
        "status": "unaffected",
        "version": "29.2.0",
        "versionType": "semver"
      }
    ]
  },
  {
    "defaultStatus": "unaffected",
    "platforms": [
      "Windows"
    ],
    "product": "Compose",
    "vendor": "Docker",
    "versions": [
      {
        "status": "unaffected",
        "version": "5.1.0",
        "versionType": "semver"
      }
    ]
  }
]

Source	Link
zerodayinitiative	www.zerodayinitiative.com/advisories/ZDI-CAN-28304/
docs	www.docs.docker.com/desktop/release-notes/
github	www.github.com/docker/cli/pull/6713

Parameter	Position	Path	Description	CWE
docker-compose.exe	path	C:\ProgramData\Docker\cli-plugins	Docker CLI on Windows searches for plugin binaries in C:\ProgramData\Docker\cli-plugins; a low-privileged attacker can place malicious CLI plugin binaries in this directory which are executed when a victim user opens Docker Desktop or uses Docker CLI plugin features, allowing privilege escalation when the docker CLI is executed as a privileged user.	CWE-427
docker-buildx.exe	path	C:\ProgramData\Docker\cli-plugins	Docker CLI on Windows searches for plugin binaries in C:\ProgramData\Docker\cli-plugins; a low-privileged attacker can place malicious CLI plugin binaries in this directory which are executed when a victim user opens Docker Desktop or uses Docker CLI plugin features, allowing privilege escalation when the docker CLI is executed as a privileged user.	CWE-427

17 Jun 2026 08:38Current

5.9Medium risk

Vulners AI Score5.9

CVSS 3.18

CVSS 47

EPSS0.0043

SSVC

CWE-427