Fluid Attacks Database

Description

Docker CLI Plugins: Uncontrolled Search Path Element Leads to Local Privilege Escalation on Windows in github.com/docker/cli Docker CLI Plugins: Uncontrolled Search Path Element Leads to Local Privilege Escalation on Windows in github.com/docker/cli

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem	Package	Affected version	Patched versions
go	github.com/docker/cli	>=19.03.0 <29.2.0	29.2.0
go	github.com/docker/compose/v5	>=0 <5.1.0	5.1.0
go	github.com/docker/compose/v2	>=2.31.0 <=2.40.3	-
go	github.com/docker/compose	-	-

Aliases

1. CVE-2025-155582. NVD-2025-155583. OSV-2025-155584. OSV-GO-2026-46105. GHSA-p436-gjf2-799p6. GCVE-2025-155587. GHSA-p436-gjf2-799p

References

1. https://github.com/docker/cli/security/advisories/GHSA-p436-gjf2-799p2. https://github.com/docker/cli/pull/67133. https://github.com/docker/compose/pull/123004. https://github.com/docker/cli/commit/13759330b1f7e7cb0d67047ea42c5482548ba7fa5. https://docs.docker.com/desktop/release-notes6. https://www.zerodayinitiative.com/advisories/ZDI-CAN-283047. https://github.com/docker/cli

Does your application use this vulnerable software?

During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.