ThreatCluster

Docker Compose Vulnerability Allows Host-Level File Overwrites

First seen 10 Nov 2025, 11:52 UTC • •15

Article Content

1 / 3

Browse articles

ThreatCluster •March 12, 2026 at 13:27 UTC

A vulnerability in Docker Compose, identified as CVE-2025-62725, has been discovered, allowing attackers to perform path traversal attacks that can lead to host-level file overwrites. The flaw was reported by Imperva's Ron Masas in early October 2025, prompting urgent upgrade recommendations for users of the orchestration tool.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Answers cite the sources they use

Updated 218d ago How this analysis works

More articles in this cluster (2)

Threat Graph

8 entities, 16 inferred relationships (STIX 2.1).

The full threat graph for this incident is free in the 7-day Starter trial.

Create free account

No card · 30 seconds

See everything included

Technique (3)

Data Breach
Malware
Zero-day Exploit

Vulnerability (1)

CVE-2025-62725

Affected Platform (4)

Docker Compose
Docker Desktop
Docker Engine
Windows

Relationships

CVE-2025-62725 targets Docker Compose
CVE-2025-62725 targets Docker Desktop
CVE-2025-62725 targets Docker Engine
CVE-2025-62725 targets Windows
Data Breach targets Docker Compose
Data Breach targets Docker Desktop
Data Breach targets Docker Engine
Data Breach targets Windows
Malware targets Docker Compose
Malware targets Docker Desktop
Malware targets Docker Engine
Malware targets Windows
Zero-day Exploit targets Docker Compose
Zero-day Exploit targets Docker Desktop
Zero-day Exploit targets Docker Engine
Zero-day Exploit targets Windows

Following this threat?

Track CVE-2025-62725 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Continue Reading

Critical Zero-Day Exploited in BeyondTrust Remote Support by China-linked Group A critical vulnerability in BeyondTrust Remote Support, tracked as CVE-2026-102764 with a CVSS score of 9.3, has been exploited by the China-linked espionage group Armory Castle since August 29, 2026. This flaw allows unauthenticated remote attackers to perform file operations, gaining root control and access to…

CISA Warns of Exploited Vulnerabilities in ProFTPD, ONLYOFFICE, Strapi, and More The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added five vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog, including critical flaws in ProFTPD, ONLYOFFICE Docs, Strapi, Apache Struts, and ISC BIND. These vulnerabilities are being by Chinese actors for cyber espionage, targeting…