CVE-2025-15558 — Docker Desktop Docker Plugins Uncontrolled Search Path Element Local Privilege Escalation Vulnerability

Affected: Docker CLI, Docker Compose, Red Hat Assisted Installer for Red Hat OpenShift Container Platform 2, Red Hat Builds for Red Hat OpenShift, Red Hat Gatekeeper 3, Red Hat Kernel Module Management Operator for Red Hat Openshift, Red Hat Machine Deletion Remediation Operator, Red Hat Multicluster Engine for Kubernetes, Red Hat Multicluster Global Hub, Red Hat OpenShift Pipelines and 19 more

Docker CLI for Windows searches for plugin binaries in C:\ProgramData\Docker\cli-plugins, a directory that does not exist by default. A low-privileged attacker can create this directory and place malicious CLI plugin binaries (docker-compose.exe, docker-buildx.exe, etc.) that are executed when a victim user opens Docker Desktop or invokes Docker CLI plugin features, and allow privilege-escalation if the docker CLI is executed as a privileged user.

This issue affects Docker CLI: through 29.1.5 and Windows binaries acting as a CLI-plugin manager using the github.com/docker/cli/cli-plugins/manager https://pkg.go.dev/github.com/docker/cli@v29.1.5+incompatible/cli-plugins/manager package, such as Docker Compose.

This issue does not impact non-Windows binaries, and projects not using the plugin-manager code.

GHSA-mqqf-5wvp-8fh8 — chi has an open redirect vulnerability in the RedirectSlashes middleware

Affected: Go: github.com/go-chi/chi/v5

### Summary

The `RedirectSlashes` function in middleware/strip.go does not perform correct input validation and can lead to an open redirect vulnerability.

### Details

The `RedirectSlashes` function performs a `Trim` to all forward slash (`/`) characters, while prepending a single one at the begining of the path (Line 52).

However, it does not trim backslashes (`\`).

```go File: middleware/strip.go 41: func RedirectSlashes(next http.Handler) http.Handler { ... 51: // Trim all leading and trailing slashes (e.g., "//evil.com", "/some/path//") 52: path = "/" + strings.Trim(path, "/") ... 62: } ```

Also, from version 5.2.2 onwards the `RedirectSlashes` function does not take into consideration the `Host` Header in the redirect response returned. This was done in order to combat another [[vulnerability](https://github.com/go-chi/chi/security/advisories/GHSA-vrw8-fxc6-2r93)](https://github.com/go-chi/chi/security/advisories/GHSA-vrw8-fxc6-2r93).

The above make it possible for a response in the following form:

``` HTTP/1.1 301 Moved Permanently Location: /\evil.com ```

The `/\evil.com` will be transformed by most browsers (Chrome, Firefox, etc. not Safari) into `//evil.com` which is a protocol relative URL and will result in a redirect to `evil.com`, essentially making it an open redirect vulnerability.

### PoC

A minimal working example can be seen below.

```go package main

import ( "fmt" "net/http"

"github.com/go-chi/chi/v5" "github.com/go-chi/chi/v5/middle…

Most recent entries from all

CVE-2025-15558 — Docker Desktop Docker Plugins Uncontrolled Search Path Element Local Privilege Escalation Vulnerability

GHSA-mqqf-5wvp-8fh8 — chi has an open redirect vulnerability in the RedirectSlashes middleware