{"schema_version":"1.3.1","id":"GO-2026-4610","modified":"2026-03-10T18:28:25Z","published":"2026-03-10T18:28:25Z","aliases":["CVE-2025-15558","GHSA-p436-gjf2-799p"],"summary":"Docker CLI Plugins: Uncontrolled Search Path Element Leads to Local Privilege Escalation on Windows in github.com/docker/cli","details":"Docker CLI Plugins: Uncontrolled Search Path Element Leads to Local Privilege Escalation on Windows in github.com/docker/cli","affected":[{"package":{"name":"github.com/docker/cli","ecosystem":"Go"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"29.2.0+incompatible"}]}],"ecosystem_specific":{"imports":[{"path":"github.com/docker/cli/cli-plugins/manager","symbols":["defaultSystemPluginDirs"]}],"custom_ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"19.03.0+incompatible"}]}]}},{"package":{"name":"github.com/docker/compose","ecosystem":"Go"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"}]}],"ecosystem_specific":{}},{"package":{"name":"github.com/docker/compose/v2","ecosystem":"Go"},"ranges":[{"type":"SEMVER","events":[{"introduced":"2.31.0"}]}],"ecosystem_specific":{}},{"package":{"name":"github.com/docker/compose/v5","ecosystem":"Go"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"5.1.0"}]}],"ecosystem_specific":{}}],"references":[{"type":"ADVISORY","url":"https://github.com/docker/cli/security/advisories/GHSA-p436-gjf2-799p"},{"type":"FIX","url":"https://github.com/docker/cli/commit/13759330b1f7e7cb0d67047ea42c5482548ba7fa"},{"type":"FIX","url":"https://github.com/docker/cli/pull/6713"},{"type":"FIX","url":"https://github.com/docker/compose/pull/12300"},{"type":"WEB","url":"https://docs.docker.com/desktop/release-notes"},{"type":"WEB","url":"https://www.zerodayinitiative.com/advisories/ZDI-CAN-28304"}],"database_specific":{"url":"https://pkg.go.dev/vuln/GO-2026-4610","review_status":"REVIEWED"}}