Ce mail provient de l'extérieur, restons vigilants

=====================================================================

                            CERT-Renater

                Note d'Information No. 2026/VULN257
_____________________________________________________________________

DATE                : 05/03/2026

HARDWARE PLATFORM(S): /

OPERATING SYSTEM(S): Systems running Docker CLI versions prior to
                                        29.2.0.

=====================================================================
https://github.com/docker/cli/security/advisories/GHSA-p436-gjf2-799p
_____________________________________________________________________


CLI plugins uncontrolled search path element local privilege
escalation on Windows
High
thaJeztah published GHSA-p436-gjf2-799p Mar 4, 2026

Package
Docker CLI (Docker)

Affected versions
>=v19.03.0, <v29.2.0

Patched versions
v29.2.0

Docker Compose (Docker)
Affected versions
>=v2.31.0, <v5.1.0
Patched versions
v5.1.0

github.com/docker/cli (Go)
Affected versions
>=v19.03.0, <v29.2.0
Patched versions
v29.2.0

github.com/docker/compose/v2 (Go)
Affected versions
>=v2.31.0
Patched versions
None

github.com/docker/compose/v5 (Go)
Affected versions
<v5.1.0
Patched versions
v5.1.0


Description

This issue affects Docker CLI through 29.1.5


Impact
_____________________________________________________________________
Docker CLI for Windows searches for plugin binaries in
C:\ProgramData\Docker\cli-plugins, a directory that does not exist by
default. A low-privileged attacker can create this directory and
place malicious CLI plugin binaries 
(docker-compose.exe, docker-buildx.exe, etc.) that are executed
when a victim user opens Docker Desktop or invokes 
Docker CLI plugin features, and allow privilege-escalation if the
docker CLI is executed as a privileged user.

This issue affects Docker CLI through v29.1.5 (fixed in v29.2.0). It
impacts Windows binaries acting as a CLI plugin manager via the
github.com/docker/cli/cli-plugins/manager package, which is consumed
by downstream projects such as 
Docker Compose.

Docker Compose became affected starting in v2.31.0, when it
incorporated the relevant CLI plugin manager code (see 
docker/compose#12300), and is fixed in v5.1.0.

This issue does not impact non-Windows binaries or projects that do
not use the plugin manager code.


Patches

Fixed version starts with 29.2.0

This issue was fixed in 1375933 (#6713), which removed
%PROGRAMDATA%\Docker\cli-plugins from the list of paths used for 
plugin-discovery on Windows.


Workarounds

None


References

    Pull request: "cli-plugins/manager: remove legacy system-wide cli-plugin path" (#6713)
    Patch: https://github.com/docker/cli/commit/13759330b1f7e7cb0d67047ea42c5482548ba7fa.patch


Credits

Nitesh Surana (niteshsurana.com) of Trend Research of TrendAI


Severity
High
7.0/ 10

CVSS v4 base metrics
Exploitability Metrics
Attack Vector Local
Attack Complexity Low
Attack Requirements None
Privileges Required Low
User interaction Passive
Vulnerable System Impact Metrics
Confidentiality High
Integrity High
Availability High
Subsequent System Impact Metrics
Confidentiality None
Integrity None
Availability None
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

CVE ID
CVE-2025-15558

Weaknesses
Weakness CWE-427


=========================================================
+ CERT-RENATER        |    tel : 01-53-94-20-44         +
+ 23/25 Rue Daviel    |    fax : 01-53-94-20-41         +
+ 75013 Paris         |   email:cert@support.renater.fr +
=========================================================