Docker Sandboxes copied host files beyond workspace limits through symlinks

A sandbox can plant symbolic links under the shared workspace that point outside the permitted tree. Host-side sbx cp followed those links when users copied files to or from the sandbox.

CVE-2026-103916 documents host-private file reads and overwrites within invoking-user permissions, fixed in Docker Sandboxes 0.51.0. An explicit host copy operation and planted link are prerequisites.

This is a copy-operation failure, not an unrestricted escape from a running microVM. The sandbox can place or alter symlinks inside a workspace it shares with the host. When a person subsequently invokes sbx cp, the host-side copy helper may follow a path through that link and read or overwrite files outside the intended workspace. The effect is limited by the host user's file permissions, but that is already a meaningful authority expansion beyond the shared tree. The advisory links the corrected behavior to Docker Sandboxes 0.51.0. The user-initiated copy and attacker-planted link are necessary stages; simply having Docker Sandboxes installed does not prove exposure.

The sandbox's ability to create a symbolic link is ordinary filesystem behavior; the failure occurs when the trusted copy command follows that link as if its target remained inside the shared workspace. File disclosure or overwrite then depends on the invoking user's host permissions and which direction the copy runs. A separate Docker Sandboxes Git-configuration flaw lets later host Git operations execute repository-controlled commands. Both require a host-side action, but neither establishes an unrestricted escape from the microVM at the moment the sandbox writes data.