CVE-2026-103916 PUBLISHED

Docker Sandboxes sbx cp follows workspace symlinks outside the authorized host directory

Assigner: Docker
Reserved: 01.10.2026 Published: 03.11.2026 Updated: 03.11.2026

Docker Sandboxes sbx cp does not safely confine host-side paths to a shared workspace. A malicious sandbox can create or replace a workspace symlink so that a later user-initiated copy reads a host file outside the workspace into the sandbox or writes sandbox-controlled data to a host path outside the workspace with the invoking user's permissions.

Metrics

CVSS 4.0

CVSS Vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
CVSS Score: 8.4

Exploitability Metrics		Vulnerable System Impact Metrics		Subsequent System Impact Metrics
Attack Vector	Local	Confidentiality	High	Confidentiality	None
Attack Complexity	Low	Integrity	High	Integrity	None
Attack Requirements	None	Availability	High	Availability	None
Privileges Required	None
User Interaction	Active

CVSS 4.0

Product Status

Vendor	Docker
Product	Docker Sandboxes
Versions	Default: unaffected affected from 0.28.0 to 0.51.0 (excl.)

Workarounds

Until upgrading, do not use sbx cp with a host-side source or destination inside a workspace writable by untrusted sandbox code. Use a host-only path for the copy instead.

Solutions

Upgrade Docker Sandboxes to version 0.51.0 or later.

Credits

Peyton Kennedy of Endor Labs finder

References

Problem Types

CWE-59: Improper Link Resolution Before File Access ('Link Following') CWE