CLEANSTART-2026-YX87977 Docker CLI for Windows searches for plugin binaries in C:\ProgramData\Docker\cli-plugins, a directory that does not exist by default

🗓️ 09 Oct 2026 00:37:20Reported by GoogleType

osv-cleanstart🔗 osv.dev👁 4 Views

Security vulnerability in flux-image-automation-controller regarding Docker CLI for Windows.

Reporter	Title	Published	Views	Family All 1000
IBM Security Bulletins	Security Bulletin: IBM Planning Analytics Cartridge has addressed a security vulnerability in Docker CLI (CVE-2025-15558)	13 Apr 202618:45	–	ibm
IBM Security Bulletins	Security Bulletin: DataStage on Cloud Pak for Data has several vulnerabilities due to open source software	7 Sep 202622:09	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities affect Data Virtualization on IBM Software Hub (April 2026 - Part 1 of 2)	1 May 202605:38	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple Vulnerabilities in watsonx.data	22 Jun 202614:32	–	ibm
Chainguard	CVE-2025-15558 vulnerabilities	6 Mar 202613:39	–	cgr
Circl	CVE-2025-15558	5 Mar 202607:40	–	circl
CNNVD	Docker CLI 安全漏洞	4 Mar 202600:00	–	cnnvd
CVE	CVE-2025-15558	4 Mar 202616:14	–	cve
Cvelist	CVE-2025-15558 Docker Desktop Docker Plugins Uncontrolled Search Path Element Local Privilege Escalation Vulnerability	4 Mar 202616:14	–	cvelist
Tenable Nessus	Docker Desktop < 4.64.0 CLI Plugin Directory Privilege Escalation (CVE-2025-15558)	12 Mar 202600:00	–	nessus

Source	Link
github	www.github.com/cleanstart-dev/cleanstart-security-advisories/tree/main/advisories/2026/CLEANSTART-2026-YX87977.json
osv	www.osv.dev/vulnerability/CVE-2025-15558
nvd	www.nvd.nist.gov/vuln/detail/CVE-2025-15558

09 Oct 2026 01:00Current

7.5High risk

Vulners AI Score7.5

CVSS 47

CVSS 3.18

EPSS0.0049

flux-image-automation-controller Docker CLI for Windows C:\ProgramData\Docker\cli-plugins