Docker Sandboxes sbx cp fails to restrict host-side paths to the designated shared workspace. A malicious sandbox can create or replace a workspace symlink such that when a later user runs sbx cp, the command reads a host file outside the workspace or writes sandbox-controlled data to a host path outside the workspace using the invoking user's permissions. This constitutes a path traversal vulnerability (CWE‑59) that allows unauthorized file read or write operations on the host system.

The vulnerability affects Docker Sandboxes versions earlier than 0.51.0. All releases prior to 0.51.0 that include the sbx cp command are susceptible. The product is Docker Sandboxes, maintained by Docker.

With a CVSS score of 8.4 the severity is high. The EPSS score is not available, but the lack of a KEV listing does not reduce the threat, because an attacker with sandbox code execution can choose arbitrary host paths during a copy operation. The exploit requires a trusted sandbox coding environment and does not rely on external network inputs, making it valuable for privileged users who can inject symlinks to bypass directory confinement.