Docker cp Copyout Path Traversal Container Escape - Host Filesystem Write

Ethan Andrews@eandrews

•updated Jun 28, 2026•0•0•0

Detects attempts to perform a container escape via the docker cp command by abusing path traversal vulnerabilities or suspicious file write operations performed by the Docker daemon to the host filesystem outside of standard container paths, often associated with symbolic link extraction exploits.