Docker Sandboxes enforces read‑only intent of a host mount only for the in‑guest container bind, but it incorrectly grants write access to the underlying virtio‑fs host‑edge through the sandbox’s shared‑export alias. As a result, code running inside the sandbox can discover that path and write to a host directory that the operator intended to be read‑only. The weakness is a classic CWE‑863 misuse of permissions, enabling an attacker who obtains any unprivileged code execution inside the sandbox to tamper with host files that should remain protected, potentially altering configuration, injecting malicious data, or creating backdoors.

The vulnerability affects Docker’s Docker Sandboxes product. Specific vendor/OS combinations are not listed, and no version range is provided; any release that implements the shared‑export alias for runtime mounts may be susceptible.

The CVSS score of 5.7 indicates moderate severity. EPSS information is not available, and the vulnerability is not listed in the CISA KEV catalog. The attack vector is inferred to be internal: an attacker must have code that runs within a sandbox to locate the shared‑export path and perform a write. This limits widespread exploitation but still permits a sandbox to modify host data, which can be critical depending on the host contents.