Docker Compose trusts the path information embedded in remote OCI compose artifacts. When a layer includes the annotations com.docker.compose.extends or com.docker.compose.envfile, Compose joins the attacker‑supplied value from com.docker.compose.file/com.docker.compose.envfile with its local cache directory and writes the file there. This affects any platform or workflow that resolves remote OCI compose artifacts, Docker Desktop, standalone Compose binaries on Linux, CI/CD runners, cloud dev environments is affected. An attacker can escape the cache directory and overwrite arbitrary files on the machine running docker compose, even if the user only runs read‑only commands such as docker compose config or docker compose ps. This issue is fixed in v2.40.2.

Despite no known exploitation, this Docker vulnerability should be remediated as soon as possible.

An update of the docker package has been released.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Docker Compose trusts the path information embedded in remote OCI compose artifacts. When a layer includes     the annotations com.docker.compose.extends or com.docker.compose.envfile, Compose joins the     attackersupplied value from com.docker.compose.file/com.docker.compose.envfile with its local cache     directory and writes the file there. This affects any platform or workflow that resolves remote OCI     compose artifacts, Docker Desktop, standalone Compose binaries on Linux, CI/CD runners, cloud dev     environments is affected. An attacker can escape the cache directory and overwrite arbitrary files on the     machine running docker compose, even if the user only runs readonly commands such as docker compose     config or docker compose ps. This issue is fixed in v2.40.2. (CVE-2025-62725)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Severity
275318	Photon OS 4.0: Docker PHSA-2025-4.0-0899	Nessus	PhotonOS Local Security Checks	high
275316	Photon OS 5.0: Docker PHSA-2025-5.0-0667	Nessus	PhotonOS Local Security Checks	high
271858	Linux Distros Unpatched Vulnerability : CVE-2025-62725	Nessus	Misc.	high

Detections

Analytics

CVE-2025-62725

high

Tenable Plugins

high

high

high