CVE-2026-43503 Docker cp Copyout Path Traversal Container Escape

Ibrahim Saud@tektrix

•updated Jun 29, 2026•0•0•4

Detects the use of 'docker cp' to copy files out of a container to the host filesystem. This rule identifies suspicious patterns that may exploit the path traversal vulnerability CVE-2026-43503, which allows an attacker to escape the intended destination directory on the host.