High severity · published Mar 4, 2026
CVE-2025-15558
Docker Desktop Docker Plugins Uncontrolled Search Path Element Local Privilege Escalation Vulnerability
8.0
CVSS
0.5%
EPSS
No
On KEV
Description
Docker CLI for Windows searches for plugin binaries in C:\ProgramData\Docker\cli-plugins, a directory that does not exist by default. A low-privileged attacker can create this directory and place malicious CLI plugin binaries (docker-compose.exe, docker-buildx.exe, etc.) that are executed when a victim user opens Docker Desktop or invokes Docker CLI plugin features, and allow privilege-escalation if the docker CLI is executed as a privileged user.
This issue affects Docker CLI: through 29.1.5 and Windows binaries acting as a CLI-plugin manager using the github.com/docker/cli/cli-plugins/manager https://pkg.go.dev/github.com/docker/cli@v29.1.5+incompatible/cli-plugins/manager package, such as Docker Compose.
This issue does not impact non-Windows binaries, and projects not using the plugin-manager code.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
Required
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 43% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
DC
Docker CLI · Docker
All versions, or not specified · source: vendor
CL
Command Line Interface · Docker
through 29.1.5 · source: NVD
In the news
VulnerabilityHigh
ZDI-26-152: Docker Desktop Docker Plugins Uncontrolled Search Path Element Local Privilege Escalation Vulnerability
This vulnerability allows local attackers to escalate privileges on affected installations of Docker Desktop. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The ZDI has assigned a CVSS rating of 7.8. The following CVEs are assigned: CVE-2025-15558.
Mar 6, 2026·Zero Day Initiative
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-15558
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-15558
Release Notes
https://docs.docker.com/desktop/release-notes/
Issue Tracking
https://github.com/docker/cli/pull/6713
Not Applicable
https://www.zerodayinitiative.com/advisories/ZDI-CAN-28304/
access.redhat.com
https://access.redhat.com/security/cve/CVE-2025-15558
bugzilla.redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=2444574
security.access.redhat.com
https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-15558.json
More from Docker CLI
7.1
CVE-2026-17106
Tar extraction in moby/go-archive can write outside the destination directory via link following