Forwarded from Taiwan Computer Network Crisis Management and Coordination Center (TACERT-ANA-2025110405112828)

[Content Description]
Docker Compose is an application tool used to define and manage multiple containers, simplifying deployment processes and improving development efficiency. Docker has released a critical security vulnerability update (CVE-2025-62725, CVSS 4.x: 8.9) and an updated version. This is a path traversal vulnerability that allows attackers to bypass Compose's cache directory and overwrite arbitrary files on the host machine.

[Affected Platforms]
Docker Compose versions prior to v2.40.2 (excluding v2.40.2)

[Recommended Actions]
Update to Docker Compose version v2.40.2 or later

[References]
1. https://www.twcert.org.tw/tw/cp-169-10485-6b5b2-1.html