Docker Compose CVE-2025-62725

Exploitation requires the victim's environment to resolve a remote OCI compose artifact controlled by the attacker, where a layer carries the com.docker.compose.extends or com.docker.compose.envfile annotation and the attacker sets a traversal path in com.docker.compose.file / com.docker.compose.envfile. The victim must invoke a docker compose operation against that artifact - but notably this includes read-only subcommands (docker compose config, docker compose ps), lowering the interaction bar. Affected are Docker Compose v2.34.0 through before v2.40.2 (Docker Desktop, standalone Linux binaries, CI/CD runners, cloud dev environments). Limiting factors: the attacker cannot act without inducing the victim to reference a hostile artifact (UI:A / AT:P), and non-affected/patched versions (>= 2.40.2) reject paths containing separators or escaping the cache directory.

This is a genuine priority, not a high-CVSS-but-low-risk issue, though it is not a mass-exploitable internet-facing flaw. The CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:N/UI:A) indicates a network-reachable, low-complexity, unauthenticated bug, but two tempering metrics matter: AT:P (a specific attack requirement - the victim must resolve an attacker-controlled OCI artifact) and UI:A (active user interaction - someone must run a docker compose command against that artifact). EPSS is notably elevated at 13.70% (96th percentile), reflecting a clear, well-understood path-traversal primitive with a public fix commit, which often precedes exploit development. It is NOT in CISA KEV (no active exploitation confirmed) and no public exploit code was identified - only the vendor fix commit and a regression test, which are not weaponized exploits. The impact is severe (arbitrary file overwrite on the host, including via read-only subcommands), credibly enabling code execution or privilege escalation, which justifies the H ratings across confidentiality/integrity/availability. Net: a high-value target for supply-chain/CI-runner attacks where a malicious registry reference can be planted, but exploitation still depends on luring a victim into pulling a hostile artifact rather than unconditional remote compromise.

An attacker publishes a malicious OCI compose artifact to a registry and tricks a developer or CI/CD pipeline into referencing it (e.g., a poisoned image/compose reference in a repo). When the victim runs docker compose - even a read-only command like docker compose config or docker compose ps - the attacker-controlled com.docker.compose.file/envfile annotation path traverses out of the cache directory and overwrites an arbitrary host file (e.g., a shell profile, cron, or binary), leading to code execution. No public exploit code exists, but the fix commit and its test cases clearly document the traversal technique.