CVE-2026-43503 Docker cp Copyout Container Escape via Path Traversal

Ibrahim Saud@tektrix

•updated Jun 29, 2026•0•0•1

This rule detects potentially malicious attempts to escape a container or manipulate the host filesystem using the 'docker cp' command. It identifies commands that contain directory traversal patterns (e.g., '../', '..\') or direct references to the host filesystem via '/proc/self/root'.