Docker CLI Plugins: Uncontrolled Search Path Element Leads to Local Privilege Escalation on Windows in github.com/docker/cli
Docker CLI Plugins: Uncontrolled Search Path Element Leads to Local Privilege Escalation on Windows in github.com/docker/cli
01
describes (1)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2025-15558US | high8.0 | — | ||
Docker CLI for Windows searches for plugin binaries in C:\ProgramData\Docker\cli-plugins, a directory that does not exist by default. A low-privileged attacker can create this dire… | ||||
02
references
External citations — patches, advisories, analysis.
- https://docs.docker.com/desktop/release-notesWEB
- https://github.com/docker/cli/commit/13759330b1f7e7cb0d67047ea42c5482548ba7faFIX
- https://github.com/docker/cli/pull/6713FIX
- https://github.com/docker/cli/security/advisories/GHSA-p436-gjf2-799pADVISORY
- https://github.com/docker/compose/pull/12300FIX
- https://www.zerodayinitiative.com/advisories/ZDI-CAN-28304WEB
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan