Docker CLI for Windows searches for plugin binaries in C:\ProgramData\Docker\cli-plugins, a directory that does not exist by default. A low-privileged attacker can create this directory and place malicious CLI plugin binaries (docker-compose.exe, docker-buildx.exe, etc.) that are executed when a victim user opens Docker Desktop or invokes Docker CLI plugin features, and allow privilege-escalation if the docker CLI is executed as a privileged user.

This issue affects Docker CLI: through 29.1.5 and Windows binaries acting as a CLI-plugin manager using the github.com/docker/cli/cli-plugins/manager https://pkg.go.dev/github.com/docker/cli@v29.1.5+incompatible/cli-plugins/manager  package, such as Docker Compose.

This issue does not impact non-Windows binaries, and projects not using the plugin-manager code.

Metrics

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Attack Requirements None

User Interaction Passive

Vulnerable System Confidentiality Impact High

Vulnerable System Integrity Impact High

Vulnerable System Availability Impact High

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction Required

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00005.

Exploitation none

Automatable no

Technical Impact total

Affected Vendors & Products

Vendors Products
Docker Subscribe
Composer Subscribe
Docker Subscribe

No data.

No data.

OpenCVE Enrichment is a feature of OpenCVE that uses AI to automatically link vendors and products to CVEs. Learn more on GitHub.

Vendors Products
Docker Subscribe
Composer Subscribe
Docker Subscribe
Advisories
Source ID Title
Github GHSA Github GHSA GHSA-p436-gjf2-799p Docker CLI Plugins: Uncontrolled Search Path Element Leads to Local Privilege Escalation on Windows
Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References
Link Providers
https://docs.docker.com/desktop/release-notes/ cve-icon cve-icon cve-icon
https://github.com/docker/cli/pull/6713 cve-icon cve-icon cve-icon
https://nvd.nist.gov/vuln/detail/CVE-2025-15558 cve-icon
https://www.cve.org/CVERecord?id=CVE-2025-15558 cve-icon
https://www.zerodayinitiative.com/advisories/ZDI-CAN-28304/ cve-icon cve-icon cve-icon
History

Thu, 05 Mar 2026 12:15:00 +0000

Type Values Removed Values Added
References
Metrics threat_severity

None

 cvssV3_1

{'score': 7.3, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H'}

threat_severity

Important

Thu, 05 Mar 2026 09:15:00 +0000

Type Values Removed Values Added
First Time appeared Docker
Docker composer
Docker docker
Vendors & Products Docker
Docker composer
Docker docker

Wed, 04 Mar 2026 18:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Wed, 04 Mar 2026 16:30:00 +0000

Type Values Removed Values Added
Description Docker CLI for Windows searches for plugin binaries in C:\ProgramData\Docker\cli-plugins, a directory that does not exist by default. A low-privileged attacker can create this directory and place malicious CLI plugin binaries (docker-compose.exe, docker-buildx.exe, etc.) that are executed when a victim user opens Docker Desktop or invokes Docker CLI plugin features, and allow privilege-escalation if the docker CLI is executed as a privileged user. This issue affects Docker CLI: through 29.1.5 and Windows binaries acting as a CLI-plugin manager using the github.com/docker/cli/cli-plugins/manager https://pkg.go.dev/github.com/docker/cli@v29.1.5+incompatible/cli-plugins/manager  package, such as Docker Compose. This issue does not impact non-Windows binaries, and projects not using the plugin-manager code.
Title Docker Desktop Docker Plugins Uncontrolled Search Path Element Local Privilege Escalation Vulnerability
Weaknesses CWE-427
References
Metrics cvssV4_0

{'score': 7, 'vector': 'CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/AU:N/R:U'}

Projects

Sign in to view the affected projects.

cve-icon MITRE

Status: PUBLISHED

Assigner: Docker

Published:

Updated: 2026-03-05T04:55:47.099Z

Reserved: 2026-02-03T19:51:18.184Z

Link: CVE-2025-15558

cve-icon Vulnrichment

Updated: 2026-03-04T17:49:59.078Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-03-04T17:16:14.763

Modified: 2026-03-04T18:08:05.730

Link: CVE-2025-15558

cve-icon Redhat

Severity : Important

Publid Date: 2026-03-04T16:14:32Z

Links: CVE-2025-15558 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-03-05T09:08:29Z

Weaknesses