CVE-2025-62725: Path Traversal in Docker Compose

The Path Traversal vulnerability in Docker Compose allows an attacker to read arbitrary files on the system where Docker Compose is running. This could include sensitive configuration files, credentials, or other data that could be used to compromise the system or gain access to other resources. The attack vector involves crafting malicious OCI artifact layer annotations that, when processed by Docker Compose, lead to the disclosure of files outside the intended directory. Successful exploitation could lead to data breaches, privilege escalation, and potential compromise of the entire host system. While the direct impact is file reading, the files read could contain credentials or configuration data that could be used for further attacks.

1. Reserved2025-10-20
2. Published2025-10-30
3. Modified2026-03-03
4. EPSS updated2026-03-23

The primary mitigation for CVE-2025-62725 is to upgrade Docker Compose to version 2.40.2 or later. If an immediate upgrade is not possible due to compatibility issues or breaking changes, consider implementing stricter file access controls on the host system to limit the potential impact of a successful exploit. Review and restrict the permissions granted to the Docker Compose user. While a WAF or proxy cannot directly prevent this vulnerability, they can be configured to monitor for suspicious file access patterns. After upgrading, confirm the fix by attempting to access a file outside the intended directory using a crafted OCI artifact layer annotation; the access should be denied.