Docker Compose has a critical path traversal vulnerability (CVE-2025-62725) that allows attackers to write arbitrary files on the host system, urging users to upgrade to version 2.40.2. Additionally, Docker fixed a DLL hijacking flaw in its Windows Installer, emphasizing the importance of timely updates for Docker security. #DockerCompose #CVE202562725 #DockerDesktop #DLLHijacking
Keypoints
- A high-severity path traversal flaw was found in Docker Compose, affecting OCI-based artifact support.
- The vulnerability allows attackers to escape the cache directory and write files anywhere on the host system.
- Docker responded quickly with a fix, recommending users upgrade to version 2.40.2 to stay protected.
- Another flaw in Docker Desktop’s Windows Installer was fixed, which involved DLL hijacking vulnerabilities.
- Experts emphasize the importance of keeping both Docker and host systems up to date for security.
Read More: https://www.theregister.com/2025/10/30/docker_compose_desktop_flaws/