Docker cp Copyout Path Traversal Container Escape (docker-cp-copyout-destination-escape)

Ibrahim Saud@tektrix

•updated Jun 29, 2026•1•0•31

Detects the usage of the 'docker cp' command containing directory traversal sequences ('../') in the destination argument. This behavior is associated with a known container escape technique where an attacker can overwrite files on the host filesystem by escaping the container's designated storage path.