Local privilege escalation via writable plugin search directory

Uncontrolled plugin search in Docker CLI 19.03.0 through 29.1.5 allows local users on Windows to execute code as a privileged user. The Windows plugin manager includes C:\ProgramData\Docker\cli-plugins in its default discovery list even though low-privileged users can create that absent directory and populate it with plugin executables. Exploitation requires a separate victim to start Docker Desktop or invoke a plugin feature with greater privileges, which runs an attacker-planted binary in that victim's context.