Docker cp path traversal escape targeting sensitive host paths (docker-cp-copyout-destination-escape)

Ibrahim Saud@tektrix

•updated Jun 29, 2026•0•0•1

Detects the use of 'docker cp' to copy files to or from sensitive host paths, such as cron, password files, SSH keys, or system directories, which often indicates attempts to escape container isolation or establish persistence on the host.