Docker cp Copyout Destination Path Traversal Container Escape (CVE-2026-55199)

Ibrahim Saud@tektrix

•updated Jun 29, 2026•0•0•2

Detects potential container escape attempts leveraging path traversal vulnerabilities in the 'docker cp' command (e.g., CVE-2026-55199). The rule identifies file creation events triggered by docker processes where the target file path is outside the expected Docker root or temporary directory structures, suggesting an effort to write files to arbitrary locations on the host filesystem.