Tia N.List

Reported by 2 outlets

CopyEscape Docker Flaw Lets Malicious Containers Overwrite Host Files and Execute Code

hot0.0
Why this score
Breadth
1.00 / 2.0 · 2 sources
Authority
1.20 / 2.0 · best outlet weight
Severity
1.00 / 5.0 · CVSS + content signals
Velocity
0.00 / 2.0 · updates in 48h
Pickup speed
0.57 / 0.6 · time to second source
Recency
× 0.00 temporal multiplier
Community
+ 0.00 / 1.5 · reddit signal
Score
0.0 / 10 = base × recency + community
cyberpress.orggbhackers.com CVE-2026-17106 first seen 63d ago

Analysis

CopyEscape, tracked as CVE-2026-17106, is a destination-escape flaw in the docker cp copy-out path, identified by Imperva researchers and listed by Docker as affecting the docker container cp command. During a container-to-host copy the daemon walks the requested container path, builds a tar archive, and hands it to the CLI on the host for extraction. A process inside a malicious container can race that walk: Ron Masas showed Docker may first record a path as a directory and then see it as a symbolic link while writing archive metadata, producing a tar stream that holds a symlink followed by entries resolving outside the destination.

The result is a host-side file write primitive, not automatic full host control. It runs with the permissions of the user or automation that executed docker cp, and the reporting notes this can mean code execution as the local user and, on Linux systems where copy operations run elevated, as root.

No in-the-wild exploitation appears in the coverage. The practical exposure sits in CI systems, backup jobs, and admin workflows that copy data out of containers they do not fully trust. Watch for a fixed Docker release, public PoC code, and guidance on restricting docker cp against untrusted images until then.

Timeline

  1. original reporting

    CopyEscape Docker Flaw Lets Malicious Containers Overwrite Host Files and Execute Code

    cyberpress.org · 62d ago · August 12th, 2026

    A newly disclosed Docker vulnerability, tracked as CVE-2026-17106, allows a malicious container to break out of the destination specified by docker cp and overwrite files on the host running the Docker CLI. The flaw does not automatically give a container unrestricted host control. Instead, it converts a copy-out operation into a host-side write primitive, operating with the permissions of the user or automation process that launches it. Imperva researchers identified the issue in Docker’s archive pipeline, and Docker lists it as a destination-escape flaw in the docker container cp command. CopyEscape Docker Flaw Docker cp does not directly transfer files between two filesystems. For a container-to-host copy, the daemon walks the requested container path, creates a tar archive, and sends that archive to the CLI for extraction. The container controls the archive’s source data, while the host-side CLI performs the filesystem operations. Security relies on two requirements: the archive must represent a consistent source filesystem, and the extractor must prevent every archive entry from resolving outside the destination. Docker Tar Extraction Flow (Source: Imperva) A process running in a malicious container can alter a pathname while Docker builds the archive. Ron Masas showed that Docker may first record a path as a directory, then observe it as a symbolic link when creating archive metadata. The tar stream can consequently contain a symlink followed by entries that appear to b

  2. update from gbhackers.com

    Docker CopyEscape Vulnerability Enables Host File Overwrite and Root Code Execution

    gbhackers.com · 63d ago · August 12th, 2026

    A critical vulnerability in Docker, tracked as CVE-2026-17106 and referred to as “CopyEscape,” allows malicious containers to overwrite files on the host system using the widely utilized docker cp command. This flaw can lead to code execution as the local user and, potentially, as root on Linux systems where copy operations are performed with elevated […] The post Docker CopyEscape Vulnerability Enables Host File Overwrite and Root Code Execution appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform .

  3. mentioned by gbhackers.com

    Docker CopyEscape CVE-2026-17106 Lets Malicious Containers Overwrite Host Files

    gbhackers.com · 13d ago · September 30th, 2026

  4. update from cyberpress.org

    Docker CopyEscape Vulnerability Lets Containers Write Outside Intended Host Paths

    cyberpress.org · 13d ago · September 30th, 2026

    Imperva Red Team researcher Ron Masas discovered the issue in Docker’s archive-handling pipeline. CopyEscape abuses the trust boundary between the attacker-controlled container filesystem and the host-side extraction process. The attack combines a time-of-check/time-of-use race in archive creation with unsafe symlink handling during extraction. When the Docker CLI extracts a subsequent child entry through that symlink, the write can be redirected outside the user-selected destination directory. This turns a routine command such as docker cp container:/path ./output into a host-side arbitrary fi

Source on GitHub