CVE-2026-771799.4CriticalCWE-59
Docker Sandboxes guest can write arbitrary macOS host files via a symlink in the virtio-fs stored-path fallback
Docker · Docker Sandboxes
Not in CISA KEVVendor fix available
0.2%probability of exploitation in the next 30 days
9th percentile
050100
Higher than 9% of scored CVEs
9.4CriticalCVSS 4.0
LowMediumHighCrit.
DescriptionNVD
On macOS, the virtio-fs host server used by Docker Sandboxes improperly follows symlinks when reopening an unlinked file from a stored path. A malicious guest can replace a parent directory with a symlink, escape the shared workspace, and read or modify arbitrary host files as the VMM user, potentially achieving host code execution.
Coverage1 article · 1 outlet
First in our coverage: SecurityOnline, 17 Sep.
- Docker Fixes Critical Sandbox Flaws Allowing Host File Writes and Socket AccessSecurityOnline · first in our coverage
New articles also arrive in the RSS feed.