{"id":23248,"date":"2026-08-12T05:00:17","date_gmt":"2026-08-12T05:00:17","guid":{"rendered":"https:\/\/scannn.com\/docker-copyescape-vulnerability-enables-host-file-overwrite-and-root-code-execution\/"},"modified":"2026-08-12T05:00:17","modified_gmt":"2026-08-12T05:00:17","slug":"docker-copyescape-vulnerability-enables-host-file-overwrite-and-root-code-execution","status":"publish","type":"post","link":"https:\/\/scannn.com\/lv\/docker-copyescape-vulnerability-enables-host-file-overwrite-and-root-code-execution\/","title":{"rendered":"Docker CopyEscape Vulnerability Enables Host File Overwrite and Root Code Execution"},"content":{"rendered":"\n
\n

A critical vulnerability in Docker, tracked as CVE-2026-17106 and referred to as \u201cCopyEscape,\u201d allows malicious containers to overwrite files <\/a>on the host system using the widely utilized `docker cp` command. <\/p>\n

This flaw can lead to code execution as the local user and, potentially, as root on Linux systems where copy operations are performed with elevated privileges.<\/p>\n

Docker CopyEscape Vulnerability<\/strong><\/h2>\n

Researchers at Imperva Threat Research identified the issue in Docker\u2019s container-to-host archive-copy workflow. Docker has confirmed that this vulnerability also impacts `sbx cp`, the copy utility used by Docker Sandboxes. The problem arises when a user attempts to copy files from an attacker-controlled container or sandbox.<\/p>\n

Typically, a command like `docker cp container:\/file.txt .\/file.txt` is designed to write only to the user-specified destination. However, Docker does not perform a simple direct file copy. <\/p>\n

Instead, the daemon packages the requested container files into a tar archive, and the Docker CLI then extracts it on the local machine. CopyEscape exploits weaknesses in both parts of this process.<\/p>\n

First, an attacker can manipulate the live container\u2019s filesystem while Docker builds the archive. Docker\u2019s archiving routine inspects a path multiple times: first, to determine whether it is a directory, and again to create its tar metadata. <\/p>\n

Tar Stream Output (Source: Imperva)<\/figcaption><\/figure>\n

A running container can alter that path between these checks, resulting in an archive that describes contradictory filesystem states.<\/p>\n

For instance, if Docker initially identifies an object as a directory, an attacker could replace it with a symbolic link before the archive metadata is completed. <\/p>\n

Consequently, the archive could contain a symlink entry followed by a child file that supposedly exists beneath that symlink.<\/p>\n

The second weakness occurs during extraction on the host system. While the Docker CLI attempts to validate symlink targets by constructing a path, it ultimately creates the symlink using the original attacker-controlled archive value. <\/p>\n

This discrepancy allows an absolute symlink to point outside of the intended destination directory.<\/p>\n

When Docker extracts a child entry via that symlink, the operating system resolves the link and writes the attacker\u2019s file to an arbitrary path on the host accessible to the user running `docker cp`. On macOS, this extraction happens on the host rather than inside Docker Desktop\u2019s Linux virtual machine. <\/p>\n

An attacker could overwrite crucial files, including shell startup files, SSH configuration<\/a>, cloud credentials, source code, executables, or LaunchAgent persistence files. A modified shell configuration file could execute malicious commands the next time the victim opens a terminal.<\/p>\n

Linux environments face even graver risks, especially when administrators, continuous integration (CI) workers, or automation tools invoke `sudo docker cp`. <\/p>\n

Imperva demonstrated that<\/a> replacing `\/usr\/bin\/runc` with an attacker-controlled script could lead to root code execution during a subsequent Docker operational phase. <\/p>\n

The vulnerability does not directly grant root privileges through the Docker daemon; instead, it exploits permissions already granted to the local copy command.<\/p>\n

The potential impact is significant for developer systems, CI\/CD infrastructure, incident response workflows, and AI-agent sandbox environments. Simply retrieving logs, build artifacts, forensic evidence, or generated code from an untrusted container could trigger an overwrite on the host system.<\/p>\n

Docker users are encouraged to upgrade to Docker Engine and CLI version 29.7.2 or later, and Docker Desktop version 4.86.0 or later. <\/p>\n

Until patches are implemented, organizations should refrain from copying files from running or untrusted containers, stop containers before retrieval, avoid root-level copy automation, and use disposable virtual machines or low-privilege accounts when analyzing suspicious containers.<\/p>\n

Stop new phishing & malware before they compromise your business.\u00a0Integrate live intel from 15K SOCs around the world<\/a><\/strong><\/p>\n<\/div>\n

Source link <\/a><\/p>\n","protected":false},"excerpt":{"rendered":"

A critical vulnerability in Docker, tracked as CVE-2026-17106 and referred to as \u201cCopyEscape,\u201d allows malicious containers to overwrite files on the host system using the widely utilized `docker cp` command. This flaw can lead to code execution as the local user and, potentially, as root on Linux systems where copy operations are performed with elevated […]<\/p>\n","protected":false},"author":16,"featured_media":23249,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[143],"tags":[],"class_list":["post-23248","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-ai"],"_links":{"self":[{"href":"https:\/\/scannn.com\/lv\/wp-json\/wp\/v2\/posts\/23248","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/scannn.com\/lv\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/scannn.com\/lv\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/scannn.com\/lv\/wp-json\/wp\/v2\/users\/16"}],"replies":[{"embeddable":true,"href":"https:\/\/scannn.com\/lv\/wp-json\/wp\/v2\/comments?post=23248"}],"version-history":[{"count":0,"href":"https:\/\/scannn.com\/lv\/wp-json\/wp\/v2\/posts\/23248\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/scannn.com\/lv\/wp-json\/wp\/v2\/media\/23249"}],"wp:attachment":[{"href":"https:\/\/scannn.com\/lv\/wp-json\/wp\/v2\/media?parent=23248"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/scannn.com\/lv\/wp-json\/wp\/v2\/categories?post=23248"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/scannn.com\/lv\/wp-json\/wp\/v2\/tags?post=23248"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}