Docker Compose improperly limits pathname resolution when handling remote OCI compose artifacts containing the annotations com.docker.compose.extends or com.docker.compose.envfile. It joins attacker-controlled values from com.docker.compose.file or com.docker.compose.envfile with its local cache directory path and writes files there without sufficient validation. This allows an attacker to perform path traversal and overwrite arbitrary files on the host machine, even when running read-only commands such as 'docker compose config' or 'docker compose ps'. The vulnerability affects all Docker Compose versions prior to 2.40.2 and impacts any platform or workflow that resolves remote OCI compose artifacts.

An attacker can escape the intended cache directory and overwrite arbitrary files on the machine running Docker Compose. This can lead to unauthorized file modification or code execution depending on the files overwritten. The vulnerability can be exploited even when users run read-only Docker Compose commands, increasing the attack surface. The CVSS 4.0 base score is 8.9 (high severity), reflecting network attack vector, low attack complexity, partial attack traceability, no privileges required, and high impact on confidentiality, integrity, availability, and security requirements.

A fix is available in Docker Compose version 2.40.2. Users and administrators should upgrade to version 2.40.2 or later to remediate this vulnerability. There is no indication that any temporary workaround or mitigation is effective or recommended. Applying the official fix is the advised course of action.