Docker cp Copyout Destination Path Traversal Container Escape

Ibrahim Saud@tektrix

•updated Jun 29, 2026•2•0•25

Detects the use of 'docker cp' commands containing path traversal sequences (e.g., '../') in the destination path. This pattern is indicative of an attempt to escape the container filesystem boundary and write arbitrary files to the host system by exploiting vulnerabilities in the docker cp utility.