Docker Compose 存在通过 github.com/docker/compose 中 OCI Artifact Layer 注解实现的路径遍历漏洞

攻击者可以利用此路径遍历漏洞，通过修改OCI Artifact层注释，访问Docker Compose配置目录之外的文件系统。这可能导致敏感信息泄露，例如密码、API密钥或其他机密数据。更严重的后果是，攻击者可能能够修改或删除关键系统文件，从而导致服务中断或系统崩溃。由于Docker Compose广泛应用于容器化应用的部署和管理，该漏洞的潜在影响范围非常广泛，可能影响到整个容器化环境的安全。

Organizations using Docker Compose in production environments, particularly those with sensitive data stored on the host system or within Docker containers, are at risk. Environments with less stringent file access controls are also more vulnerable. Developers using Docker Compose for local development should also apply the fix to prevent potential compromise.

• linux / server: Monitor Docker Compose logs for unusual file access attempts. Use journalctl -u docker-compose to filter for errors related to file access.

journalctl -u docker-compose | grep "file not found" -i

• go: Inspect Docker Compose source code for instances of os.Open or similar functions that handle file paths derived from user input. Look for potential path traversal vulnerabilities. • generic web: If Docker Compose is exposed via a web interface, monitor access logs for requests attempting to access files outside the intended directory.

1. 2025-10-30Disclosure

   disclosure

1. 已保留2025-10-20
2. 发布日期2025-10-30
3. 修改日期2026-03-03
4. EPSS 更新日期2026-03-23

最有效的缓解措施是立即升级到Docker Compose 2.40.2或更高版本。如果无法立即升级，可以考虑以下临时缓解措施：限制Docker Compose的权限，使其只能访问必要的目录；实施严格的文件访问控制策略，防止未授权访问；监控Docker Compose的日志，检测异常活动。升级后，请验证配置是否正确，并确认漏洞已成功修复。