CVE-2025-62725: Docker Compose Path Traversal Vulnerability

CVE-2025-62725 Overview

CVE-2025-62725 is a Path Traversal vulnerability affecting Docker Compose's handling of remote OCI compose artifacts. The vulnerability exists because Docker Compose improperly trusts path information embedded in remote OCI compose artifacts. When a layer includes the annotations com.docker.compose.extends or com.docker.compose.envfile, Compose joins the attacker-supplied value from com.docker.compose.file or com.docker.compose.envfile with its local cache directory and writes the file there without proper validation.

This vulnerability enables an attacker to escape the cache directory and overwrite arbitrary files on the machine running docker compose, even when users only execute read-only commands such as docker compose config or docker compose ps. The vulnerability is classified as CWE-22 (Path Traversal).

Critical Impact

An attacker can overwrite arbitrary files on systems that resolve remote OCI compose artifacts, affecting Docker Desktop, standalone Compose binaries on Linux, CI/CD runners, and cloud development environments.

Affected Products

• Docker Compose versions prior to v2.40.2
• Docker Desktop (all platforms using vulnerable Compose versions)
• Standalone Compose binaries on Linux

Discovery Timeline

• 2025-10-27 - CVE CVE-2025-62725 published to NVD
• 2025-10-30 - Last updated in NVD database

Technical Details for CVE-2025-62725

Vulnerability Analysis

This Path Traversal vulnerability stems from Docker Compose's improper handling of path annotations in OCI artifacts. The vulnerable code blindly trusts the com.docker.compose.file and com.docker.compose.envfile annotation values provided by remote OCI artifacts. When processing these annotations, Compose joins these attacker-controlled values with its local cache directory path without validating that the resulting path remains within the intended cache directory boundaries.

The security implications are severe because exploitation can occur through seemingly innocuous read-only commands. A user who merely runs docker compose config or docker compose ps against a malicious OCI artifact can have arbitrary files overwritten on their system. This affects a wide range of deployment scenarios including Docker Desktop installations, standalone Compose binaries, CI/CD pipelines, and cloud development environments.

Root Cause

The root cause is insufficient path validation when handling OCI artifact annotations. The vulnerable code trusted user-supplied path components from remote OCI artifacts and directly joined them with the local cache directory without checking for path traversal sequences. This allowed attackers to include relative path components (such as ../) in the annotation values to escape the cache directory.

Attack Vector

The attack is network-based and requires user interaction. An attacker creates a malicious OCI compose artifact with specially crafted com.docker.compose.file or com.docker.compose.envfile annotations containing path traversal sequences. When a victim pulls and processes this artifact using any Docker Compose command, the malicious path values are joined with the cache directory, allowing files to be written outside the intended cache location. The attacker can target critical system files, configuration files, or other sensitive locations depending on the privileges of the user running Docker Compose.

// Security patch in pkg/remote/oci.go
// Source: https://github.com/docker/compose/commit/69bcb962bfb2ea53b41aa925333d356b577d6176

// validatePathInBase ensures a file path is contained within the base directory,
// as OCI artifacts resources must all live within the same folder.
func validatePathInBase(base, unsafePath string) error {
	// Reject paths with path separators regardless of OS
	if strings.ContainsAny(unsafePath, "\\/") {
		return fmt.Errorf("invalid OCI artifact")
	}

	// Join the base with the untrusted path
	targetPath := filepath.Join(base, unsafePath)

	// Get the directory of the target path
	targetDir := filepath.Dir(targetPath)

	// Clean both paths to resolve any .. or . components
	cleanBase := filepath.Clean(base)
	cleanTargetDir := filepath.Clean(targetDir)

	// Check if the target directory is the same as base directory
	if cleanTargetDir != cleanBase {
		return fmt.Errorf("invalid OCI artifact")
	}

	return nil
}

Source: GitHub Docker Compose Commit

Detection Methods for CVE-2025-62725

Indicators of Compromise

• Unexpected file modifications or creations outside the Docker Compose cache directory
• OCI artifacts containing path separators (/ or \) in com.docker.compose.file or com.docker.compose.envfile annotation values
• Suspicious file write operations during docker compose config, docker compose ps, or similar commands
• Evidence of files being written to sensitive system directories during Compose operations

Detection Strategies

• Monitor file system activity for writes to sensitive directories during Docker Compose execution
• Implement network-level inspection for OCI artifacts with suspicious annotation patterns
• Use SentinelOne Singularity platform to detect anomalous file system operations by Docker Compose processes
• Audit Docker Compose cache directory for unexpected path traversal attempts

Monitoring Recommendations

• Enable detailed logging for Docker Compose operations and monitor for path traversal patterns
• Implement file integrity monitoring on critical system files and configuration directories
• Deploy endpoint detection and response (EDR) solutions to identify suspicious file operations
• Monitor CI/CD pipeline logs for unexpected file system changes during Docker Compose execution

How to Mitigate CVE-2025-62725

Immediate Actions Required

• Upgrade Docker Compose to version v2.40.2 or later immediately
• Audit any OCI artifacts from untrusted sources that have been used recently
• Review file system integrity on systems that have processed remote OCI compose artifacts
• Restrict the use of remote OCI compose artifacts to trusted registries until patching is complete

Patch Information

Docker has released version v2.40.2 of Docker Compose to address this vulnerability. The fix implements the validatePathInBase function that rejects any path containing path separators and validates that the resolved target directory matches the expected base cache directory. Users should upgrade to this version immediately.

For more details, see the GitHub Security Advisory GHSA-gv8h-7v7w-r22q and the security patch commit.

Workarounds

• Avoid using remote OCI compose artifacts from untrusted sources until the patch is applied
• Run Docker Compose in isolated environments with restricted file system access
• Implement network policies to limit access to untrusted OCI registries
• Use container security tools to monitor and restrict file operations by Docker processes

# Upgrade Docker Compose to patched version
docker compose version
# If version is below v2.40.2, upgrade immediately

# For standalone binary installations
curl -SL https://github.com/docker/compose/releases/download/v2.40.2/docker-compose-linux-x86_64 -o /usr/local/bin/docker-compose
chmod +x /usr/local/bin/docker-compose

# Verify the installed version
docker-compose version