Docker cp Copyout Path Traversal Container Escape (CVE-2026-43503)

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•5

Detects potential container escape attempts via 'docker cp' path traversal attacks or suspicious shell execution spawned from the Docker daemon. The rule monitors for directory traversal sequences in 'docker cp' commands, the use of PoC tooling strings, file modifications outside expected container paths, and shell process spawning originating from Docker-related parent processes.