CVE-2025-62725: Docker Compose Vulnerable to Path Traversal via OCI Artifact Layer Annotations
Docker Compose trusts the path information embedded in remote OCI compose artifacts. When a layer includes the annotations com.docker.compose.extends or com.docker.compose.envfile, Compose joins the attacker‑supplied value from com.docker.compose.file/com.docker.compose.envfile with its local cache directory and writes the file there.
Impact This affects any platform or workflow that resolves remote OCI compose artifacts, Docker Desktop, standalone Compose binaries on Linux, CI/CD runners, cloud dev environments is affected. An attacker can escape the cache directory and overwrite arbitrary files on the machine running docker compose, even if the user only runs read‑only commands such as docker compose config or docker compose ps.
Patches v2.40.2
Workarounds NA
Other sources
Docker Compose trusts the path information embedded in remote OCI compose artifacts. When a layer includes the annotations com.docker.compose.extends or com.docker.compose.envfile, Compose joins the attacker‑supplied value from com.docker.compose.file/com.docker.compose.envfile with its local cache directory and writes the file there. This affects any platform or workflow that resolves remote OCI compose artifacts, Docker Desktop, standalone Compose binaries on Linux, CI/CD runners, cloud dev environments is affected. An attacker can escape the cache directory and overwrite arbitrary files on the machine running docker compose, even if the user only runs read‑only commands such as docker compose config or docker compose ps. This issue is fixed in v2.40.2.
— MITRE
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-62725?
CVE-2025-62725 has a medium severity due to its potential to allow an attacker to manipulate Docker Compose configurations.
How do I fix CVE-2025-62725?
To fix CVE-2025-62725, upgrade Docker Compose to version 2.40.2 or later to mitigate the vulnerability.
What type of vulnerability is CVE-2025-62725?
CVE-2025-62725 is a path manipulation vulnerability in Docker Compose that exploits user-supplied values in OCI compose artifacts.
Which versions of Docker Compose are affected by CVE-2025-62725?
Docker Compose versions prior to 2.40.2 are affected by CVE-2025-62725.
What are the consequences of exploiting CVE-2025-62725?
Exploitation of CVE-2025-62725 could lead to unauthorized modifications of Docker Compose configurations, potentially compromising the application environment.