Docker cp copyout destination path traversal container escape (docker-cp-copyout-destination-escape)

Ibrahim Saud@tektrix

•updated Jun 29, 2026•1•0•3

Detects attempts to escape a Docker container to the host filesystem by exploiting directory traversal vulnerabilities within the 'docker cp' command. It identifies suspicious CLI arguments indicating path traversal, the presence of known PoC artifacts, and file write events initiated by the Docker daemon outside of expected container directory paths.