---
id: CVE-2026-103916
title: >-
  Docker Sandboxes sbx cp follows workspace symlinks outside the authorized host
  directory
summary: >-
  Docker Sandboxes sbx cp does not safely confine host-side paths to a shared
  workspace. A malicious sandbox can create or replace a workspace symlink so
  that a later user-initiated copy reads a host file outside the workspace into
  the san…
severity: high
cvss: 8.4
cvssVector: 'CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N'
cvssSource: cna
cwe:
  - CWE-59
vendor: Docker
product: Docker Sandboxes
affected:
  - sandboxes >= 0.28.0 < 0.51.0
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-11-03T17:43:09.265927Z'
published: '2026-11-03'
updated: '2026-11-03'
sourceUpdated: '2026-11-03T17:43:23.309Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-103916'
references:
  - url: 'https://docs.docker.com/ai/sandboxes/'
  - url: 'https://docs.docker.com/ai/sandboxes/security/isolation/'
  - url: 'https://github.com/docker/sbx-releases/releases/tag/v0.51.0'
tags:
  - cve.org
epss: 0.0021
epssPercentile: 0.11313
ingestedAt: '2026-11-05T20:33:06.327Z'
---

## Overview

Docker Sandboxes sbx cp does not safely confine host-side paths to a shared workspace. A malicious sandbox can create or replace a workspace symlink so that a later user-initiated copy reads a host file outside the workspace into the sandbox or writes sandbox-controlled data to a host path outside the workspace with the invoking user's permissions.

## Affected

- `sandboxes >= 0.28.0 < 0.51.0`

## Remediation

Upgrade Docker Sandboxes to version 0.51.0 or later.

### Workarounds

Until upgrading, do not use sbx cp with a host-side source or destination inside a workspace writable by untrusted sandbox code. Use a host-only path for the copy instead.