✅ Report Title: Docker Compose Vulnerability Analysis – CVE-2025-62725

✅ Executive Summary:

- S2W Threat Intelligence Center (TALON) has published an analysis report on an Arbitrary File Write vulnerability, CVE-2025-62725, identified in Docker Compose.

  * Docker Compose: A tool used to define and run multi-container Docker applications.

- This vulnerability occurs due to insufficient validation of user-controlled input when Docker Compose processes annotations in remote OCI (Open Container Initiative) artifact layers.

- The Docker Compose versions listed below are affected by this vulnerability.

  - v2.34.0 ≤ Docker Compose < v2.40.2

📌 What Are the Detailed Information on CVE-2025-62725?

- CVE Number: CVE-2025-62725

- Disclosure or Patch Date: 2025-10-27

- Product: Docker Compose

- Vendor: Docker Inc.

- Threat Actor: N/A

- Confirmed Affected Version:

  - v2.34.0 ≤ Docker Compose < v2.40.2

- Patched Version:

  - v2.40.2 ≤ Docker Compose

- Reporter (Advisor):

  - masasron

📌 What Is the Root Cause of the Vulnerability?

- This vulnerability is caused by insufficient validation of file paths when processing layer annotations of remote OCI artifacts.

📌 How Can This Vulnerability Be Exploited?(Attack Scenario)

- If an attacker induces a victim to reference a maliciously crafted remote OCI artifact, the vulnerability can be triggered even by executing read-only commands such as docker compose ps.

- When exploited, an attacker may escape the cache directory and overwrite arbitrary files on the host system.

✅ Recommended Threat Detection and Mitigation Actions:

- The Docker Compose version in use can be verified in a CLI environment using the docker compose version command.

  - If a vulnerable version of Docker Compose is identified, upgrading to v2.40.2 or later, where the patch has been applied, is strongly recommended.

- If upgrading is not feasible, the following mitigation measures are recommended.

  - Prohibit the execution of docker compose commands that reference remote OCI artifacts from untrusted sources.

  - Minimize file system permissions for users who execute docker compose commands.

🧑‍💻 Author: S2W TALON

👉 Contact us: https://s2w.inc/en/contact

*The full report is available upon request or with a subscription to the S2W platform.