Loading vulnerability…
CopyEscape is a container-to-host arbitrary file-write vulnerability in Docker’s docker cp copy-out path, also affecting sbx cp in Docker Sandboxes. The issue arises from the combination of a time-of-check/time-of-use race during archive creation from a live container filesystem and unsafe symlink handling during archive extraction on the client side. During docker cp, Docker walks the container filesystem to build a tar archive; an attacker-controlled container can change a path between directory traversal and later stat/serialization so the archive contains an inconsistent structure, including a symlink and child entries beneath it. The client-side extractor validates a constructed destination path but creates the symlink using the original archive link target, allowing the symlink to escape the intended extraction directory. Subsequent archive entries can then be written through that symlink to locations outside the user-selected destination on the host running the Docker CLI. The flaw does not constitute a conventional kernel-level container escape, but it turns the Docker CLI into a host filesystem write primitive under the privileges of the user or process invoking the copy operation.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
docker cp and sbx cp from privileged accounts, CI runners, and administrative workstations when handling attacker-controlled containers, and prefer isolated hosts for forensic or artifact retrieval until patched versions are deployed.Patch, then assume compromise.
2 valid exploits after Mallory filtered fakes, detection scripts, and README-only repos.
Repository is a standalone PoC/distribution mirror for CopyEscape (CVE-2026-17106), a Docker `docker cp` container-to-host arbitrary file write vulnerability. It is not tied to a common exploit framework. The repo is split into `linux/` and `macos/` demos, each containing a Dockerfile, entrypoint wrapper, a C monitor program, and an LD_PRELOAD shared library; macOS also includes an orchestration script `demo-macos.sh`. Core exploit structure: the container exposes `/watched/file.txt` as the apparent copy source, but `watched_preload.c` intercepts `open/openat/fopen/stat/lstat` and redirects accesses on that path to `/watched/.file.txt.regular`, making it look like a normal top-level file. Meanwhile `monitor.c` prepares a crafted directory tree under `/watched/file.txt/`, including a large child file `aaa.txt` and a directory `escape`. It uses inotify to detect when Docker's archive/walk logic opens/accesses `aaa.txt`; at that precise moment it renames `escape` out of the way and swaps in a symlink (`.swap-escape`) pointing to a host path. This exploits the TOCTOU/symlink handling flaw described in the README so that subsequent extraction on the host follows the symlink and writes outside the intended destination. Linux path: `linux/monitor.c` targets `/usr/bin/runc`, writing a bash script payload there and marking it executable. If a privileged user runs `docker cp`, later Docker/runc activity can execute the replaced binary, yielding host code execution and creating `/imperva_red_team` as proof. macOS path: `macos/monitor.c` derives the target from `COPYESCAPE_HOST_HOME` and writes a benign marker file `<home>/pwnd`; `macos/demo-macos.sh` builds the image, runs the container, waits until ready, and invokes `docker cp` to demonstrate success. Overall purpose: provide a practical, reproducible exploit demonstrating that a malicious container can coerce a vulnerable Docker client into overwriting arbitrary host files during `docker cp`, with a safe-ish macOS marker demo and a destructive Linux privilege-escalation demonstration.
This repository is a real proof-of-concept exploit for CVE-2026-17106 ('CopyEscape'), targeting a flaw in Docker `docker cp` handling. It contains two parallel demonstrations under `linux/` and `macos/`, each built around the same technique: make `/watched/file.txt` appear to be a normal file to processes inside the container while the Docker daemon encounters a directory tree that can be pivoted into a symlink during archive creation. The exploit races Docker’s archive producer so the tar stream contains a symlink followed by a child entry beneath it; a vulnerable Docker CLI then follows that symlink during extraction and writes outside the user-selected local destination. Repository structure: both `linux/` and `macos/` contain a `Dockerfile`, `entrypoint.sh`, `monitor.c`, and `watched_preload.c`. The Dockerfiles compile a monitor binary and an LD_PRELOAD shared library inside Alpine, then package them into a runtime image. `entrypoint.sh` unsets `LD_PRELOAD` before launching the monitor so only ordinary container processes see the redirected file behavior, while the monitor itself sees the real filesystem layout. `watched_preload.c` hooks `open`, `openat`, `fopen`, `stat`, and `lstat` to transparently redirect access from `/watched/file.txt` to `/watched/.file.txt.regular`, preserving the illusion that the watched path is a regular file. `monitor.c` creates the malicious directory/symlink layout, writes the payload file, watches filesystem activity with inotify, and performs the rename-based pivot when `aaa.txt` is accessed during `docker cp` traversal. Linux PoC purpose and capability: `linux/monitor.c` stages a symlink to `/usr/bin` and writes an attacker-controlled replacement script to `/usr/bin/runc`. When the race succeeds, the host-side extraction overwrites `/usr/bin/runc`; subsequent execution of that path creates `/imperva_red_team`, demonstrating privileged host impact and effective code execution as root. This is a destructive local/container-to-host escape demonstration requiring root-level consequences on the Docker client host. macOS PoC purpose and capability: `macos/monitor.c` derives the host target from `COPYESCAPE_HOST_HOME`, stages a symlink to the user’s home directory, and writes a benign marker payload to `<HOME>/pwnd`. `macos/demo-macos.sh` automates image build, container startup, readiness checks, and the triggering `docker cp` command. Successful exploitation creates `~/pwnd`, demonstrating arbitrary host file write on Docker Desktop without destructive runtime replacement. No external network communication, C2, or remote endpoints are present. The exploit is local/container-based and relies on Docker CLI interaction with a malicious container rather than network delivery.
15 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A container-to-host arbitrary file-write vulnerability in Docker's docker cp implementation caused by a source-side filesystem TOCTOU race combined with a client-side archive extraction symlink validation flaw, enabling writes outside the intended destination and potentially leading to root code execution depending on Docker CLI privileges.
A container-to-host arbitrary file write vulnerability in Docker cp caused by a filesystem race during archive creation combined with unsafe symlink handling during extraction, potentially enabling developer-account compromise or root code execution.
A container-to-host arbitrary file-write vulnerability in Docker's docker cp command, also affecting Docker Sandboxes sbx cp copy-out, that can let an attacker-controlled container or sandbox overwrite files outside the intended destination and potentially achieve code execution on the host running the Docker CLI.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.