Docker cp Copyout Path Traversal Container Escape (CVE-2026-43503)

Ibrahim Saud@tektrix

•updated Jun 29, 2026•1•0•2

This rule detects activities indicative of a Docker container escape, specifically targeting the 'docker cp' path traversal vulnerability. It monitors for suspicious command-line patterns involving path traversal sequences ('../'), execution of shells or common utilities from container-related processes (dockerd, containerd, etc.), and the presence of known proof-of-concept artifacts or files written outside the expected container boundary.