Privilege Escalation Vulnerability in Docker Compose by Docker

CVE-2025-62725

What is CVE-2025-62725?

Docker Compose contains a vulnerability that allows attackers to manipulate the path information of remote OCI compose artifacts. Through this exploit, an attacker can use specific annotations (com.docker.compose.extends or com.docker.compose.envfile) to inject values that will be concatenated with the local cache directory. This can lead to unauthorized file overwrites on the host machine, even when executing commands that are considered read-only, such as docker compose config or docker compose ps. As a result, all environments utilizing Docker Compose, including Docker Desktop, CI/CD pipelines, and cloud development setups, are at risk of this vulnerability. The issue has been addressed in version 2.40.2.

References