Docker cp Copyout Path Traversal Container Escape (CVE-2026-43503)

Ibrahim Saud@tektrix

•updated Jun 29, 2026•0•0•6

Detects attempts to perform container escapes by abusing the 'docker cp' command. The rule identifies path traversal sequences in 'docker cp' arguments, as well as unauthorized shell or script execution spawned by container daemon processes (e.g., dockerd, containerd) following a file copy operation, and specific file creation patterns indicative of a container escape attempt.