Docker cp Copyout Path Traversal Container Escape (CVE-2026-45115)

Ibrahim Saud@tektrix

•updated Jun 29, 2026•0•0•1

Detects attempts to perform a container escape using the 'docker cp' command, where a maliciously crafted source path with traversal sequences allows the container daemon to write files outside of the container boundary. The rule monitors for suspicious 'docker cp' command executions and the creation of artifacts associated with known path traversal escape techniques in the host filesystem by the Docker daemon.