Docker cp Copyout Path Traversal Container Escape - Sensitive Host Path Write

Ibrahim Saud@tektrix

•updated Jun 29, 2026•0•0•3

Detects execution of the 'docker cp' command containing directory traversal sequences ('../', '..") in the command line arguments. This pattern is indicative of attempts to exploit path traversal vulnerabilities to read or write files outside the intended container scope, potentially leading to container escape.