Docker cp Copyout Path Traversal Container-to-Host File Write

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•0

Detects the use of 'docker cp' commands containing path traversal sequences (e.g., '..') in the destination argument. This behavior is indicative of an attempt to escape the container environment and write files to the host filesystem, potentially exploiting the 'docker-cp-copyout' vulnerability.