Threats affecting pkg:github/docker/compose

CVE-2025-62725 is a path traversal vulnerability in Docker Compose that allows an attacker to escape the local cache directory and overwrite arbitrary files on the host machine. This occurs because Docker Compose trusts path information embedded in remote OCI compose artifacts and improperly joins attacker-supplied values with local paths. The vulnerability affects multiple platforms and workflows that resolve remote OCI compose artifacts, including Docker Desktop, standalone Compose binaries on Linux, CI/CD runners, and cloud development environments. The issue is fixed in Docker Compose version 2.40.2.