Docker cp Copyout Path Traversal Container Escape (exploitarium PoC)

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•10

Detects the use of the 'docker cp' command with suspicious path traversal characters or known PoC artifacts in the destination parameter. This behavior is indicative of an attempt to exploit path traversal vulnerabilities in the Docker daemon (such as those allowing container escape) by writing files outside the container's intended scope onto the host filesystem.