🟠 High | Source: Microsoft Security Response Center
A path traversal vulnerability has been identified in Docker Compose, exploitable via maliciously crafted OCI artifact layer annotations. An attacker could potentially use this flaw to write files outside of intended directories during the handling of OCI artefacts, which may lead to arbitrary file writes on the host system. This is particularly concerning in CI/CD pipelines and containerised environments where Docker Compose is widely used.
Security Architect’s Take: Audit any pipelines or environments pulling OCI artefacts via Docker Compose and restrict the sources of OCI content to trusted registries. Apply available patches immediately and consider enforcing image signature verification to reduce exposure to malicious artefact injection.
Original advisory: CVE-2025-62725 Docker Compose Vulnerable to Path Traversal via OCI Artifact Layer Annotations