{"cve":"CVE-2025-62725","nvd":{"published":"2025-10-27T21:15:38.140","modified":"2026-10-08T11:10:00.250","status":"Deferred","description":"Docker Compose trusts the path information embedded in remote OCI compose artifacts. When a layer includes the annotations com.docker.compose.extends or com.docker.compose.envfile, Compose joins the attacker‑supplied value from com.docker.compose.file/com.docker.compose.envfile with its local cache directory and writes the file there. This affects any platform or workflow that resolves remote OCI compose artifacts, Docker Desktop, standalone Compose binaries on Linux, CI/CD runners, cloud dev environments is affected. An attacker can escape the cache directory and overwrite arbitrary files on the machine running docker compose, even if the user only runs read‑only commands such as docker compose config or docker compose ps. This issue is fixed in v2.40.2.","cvss_v4":{"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H","score":8.9},"cvss_v3":null,"cwes":["CWE-22"],"references":["https://github.com/docker/compose/commit/69bcb962bfb2ea53b41aa925333d356b577d6176","https://github.com/docker/compose/security/advisories/GHSA-gv8h-7v7w-r22q"],"products":[],"source":"nvd","synced_at":"2026-10-19T22:12:35.277909958+00:00"},"epss":{"cve":"CVE-2025-62725","score":0.13701,"percentile":0.96468,"date":"2026-10-25"},"kev":null,"osv":[{"id":"GHSA-gv8h-7v7w-r22q","url":"https://osv.dev/vulnerability/GHSA-gv8h-7v7w-r22q","summary":"Docker Compose Vulnerable to Path Traversal via OCI Artifact Layer Annotations","modified":"2025-11-27T09:09:37.102197Z","packages":[{"ecosystem":"Go","name":"github.com/docker/compose/v2","purl":"pkg:golang/github.com/docker/compose/v2","ranges":[">=2.34.0 <2.40.2"],"fixed":["2.40.2"]}]},{"id":"GO-2025-4077","url":"https://osv.dev/vulnerability/GO-2025-4077","summary":"Docker Compose Vulnerable to Path Traversal via OCI Artifact Layer Annotations in github.com/docker/compose","modified":"2026-03-03T04:57:05.845934Z","packages":[{"ecosystem":"Go","name":"github.com/docker/compose","purl":"pkg:golang/github.com/docker/compose","ranges":["all versions"],"fixed":[]},{"ecosystem":"Go","name":"github.com/docker/compose/v2","purl":"pkg:golang/github.com/docker/compose/v2","ranges":["<2.40.2"],"fixed":["2.40.2"]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}