Docker Docker CLI vulnerabilities (CVE)

CVE records published for Docker Docker CLI, newest first. Follow to get an email when a new one appears.

2 results

7.1High

CVE-2026-17106 2 months ago

Tar extraction in moby/go-archive can write outside the destination directory via link following

moby go-archive; Docker Docker Sandboxes; Docker Docker Desktop; Docker Docker Engine

The tar extraction routines in moby/go-archive (Unpack, UnpackLayer, Untar/UntarUncompressed, and the ApplyLayer helpers) do not confine filesystem operations to the destination directory. The extractor decides where each archive entry lands using lexical str…

7.0High

CVE-2025-15558 8 months ago

Docker Desktop Docker Plugins Uncontrolled Search Path Element Local Privilege Escalation Vulnerability

Docker Docker CLI; Docker Compose; Red Hat Assisted Installer for Red Hat OpenShift Container Platform 2; Red Hat Builds for Red Hat OpenShift

Docker CLI for Windows searches for plugin binaries in C:\ProgramData\Docker\cli-plugins, a directory that does not exist by default. A low-privileged attacker can create this directory and place malicious CLI plugin binaries (docker-compose.exe, docker-build…