Docker cp Copyout Path Traversal Container Escape CVE-2026-46331

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•2

Detects the use of the 'cp' command within a Docker container context to access files outside the current working directory, identified by the usage of parent directory traversal (..). This pattern is often associated with container escape attempts or unauthorized file access within a containerized environment.