Docker Desktop prior to 4.4.4 on Windows allows malicious users to move arbitrary files.
docker docker_desktop