# Docker CopyEscape (CVE-2026-17106): docker cp / sbx cp flaw lets malicious containers overwrite host files

> CVE-2026-17106 ("CopyEscape") chains a TOCTOU race in the Docker daemon's container-filesystem archiving with a symlink-confinement flaw in moby/go-archive tar extraction, so a malicious running container can make `docker cp` (or `sbx cp`) write files anywhere the invoking user can write on the host. Imperva's PoC replaced /usr/bin/runc for root code execution. Fixed in Docker Engine/CLI 29.7.2, Docker Desktop 4.86.0, Docker Sandboxes 0.38.0 and moby/go-archive 0.3.0.

- **Published:** 2026-09-30T00:00:00Z
- **Last reviewed:** 2026-09-30T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-2812
- **ID:** TL-2026-2812
- **Severity:** HIGH (CVSS 7.1)
- **Category:** VULNERABILITY
- **Status:** PATCHED
- **Detections:** 9 · **IOCs:** 8 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-17106

## Description

CopyEscape (CVE-2026-17106) was discovered by Ron Masas of Imperva's Red Team and reported to Docker on 2026-04-11. It chains two weaknesses in Docker's archive pipeline.

Producer side (daemon): when `docker cp` copies out of a running container, the daemon walks the container's live filesystem with filepath.WalkDir to build a tar stream. A process inside the container can race the walk, moving a directory aside and replacing it with a symlink between the traversal decision and the metadata (Lstat) call. Imperva's PoC used an LD_PRELOAD interposer to make a watched path appear as a regular file while presenting a directory to the daemon, and placed a large file before the pivot point, monitored via filesystem notifications, to signal when the walk reached the critical spot and widen the race window. The resulting tar holds two inconsistent entries: a symlink and a child entry that describes the directory it replaced.

Consumer side (CLI): the extractor in moby/go-archive validates a path built with filepath.Join using a lexical string-prefix check, but creates the symlink from the original hdr.Linkname value from the archive. The containment check therefore approves one path while the kernel follows another, and later entries are written through the symlink outside the user-specified destination. The same class of flaw was present in the Docker Sandboxes `sbx cp` copy-out path. The GitHub advisory GHSA-hfg8-hc9c-6c3h lists the affected go-archive helpers as Unpack, UnpackLayer, Untar, UntarUncompressed and ApplyLayer, and rates the issue CVSS v4.0 7.1 (High), CWE-22 and CWE-59. TOCTOU (CWE-367) describes the daemon-side race.

Impact is an arbitrary file create/overwrite primitive on the host, scoped to the privileges of the process running `docker cp`. On Linux, if `docker cp` is run with sudo or by root-privileged CI/automation, overwriting /usr/bin/runc (the container runtime binary) gives root code execution the next time Docker invokes it; Imperva's PoC replaced runc with a shell script. On macOS, the Docker CLI extracts archives coming from the Linux daemon VM, so a container can overwrite shell startup scripts, SSH configuration, LaunchAgents (persistence), source trees and cloud credentials. Exposed workflows include CI/CD artifact retrieval, developer log collection, incident-response evidence collection from suspected-compromised containers, and AI-agent workflows using Docker Sandboxes. User interaction is required: a user or automation must run `docker cp`/`sbx cp` against an attacker-controlled running container.

Disclosure timeline per Imperva: reported 2026-04-11, acknowledged 2026-04-14/15, CVE assigned 2026-07-24, moby/go-archive 0.3.0 and Engine/CLI 29.7.0 shipped the extraction fix 2026-07-30, functional regressions were reported 2026-07-31 leading to an extension, Docker Sandboxes 0.38.0 fixed `sbx cp` on 2026-08-06, and Docker Desktop 4.86.0 (bundling Engine 29.7.2) released and the issue was disclosed 2026-08-10. Public PoCs exist. No in-the-wild exploitation is reported and the CVE is not in CISA KEV (per Wiz). Sources disagree on the severity label: GBHackers calls it critical without a score, while the GHSA and Wiz rate it CVSS v4.0 7.1 High; this record uses the advisory score. Sources also differ on the first fixed Engine/CLI version (29.7.0 for the extraction fix; 29.7.2 is the final fixed release).

## MITRE ATT&CK

- T1204.003 User Execution: Malicious Image
- T1611 Escape to Host
- T1554 Compromise Host Software Binary
- T1059.004 Command and Scripting Interpreter: Unix Shell
- T1543.001 Create or Modify System Process: Launch Agent
- T1546.004 Event Triggered Execution: Unix Shell Configuration Modification
- T1574.006 Hijack Execution Flow: Dynamic Linker Hijacking

## Sources

- [Docker CopyEscape CVE-2026-17106 Lets Malicious Containers Overwrite Host Files](https://gbhackers.com/docker-copyescape-cve-2026-17106/)
- [CopyEscape: Taking Over Docker Hosts with docker cp | Imperva](https://www.imperva.com/blog/copyescape-taking-over-docker-hosts-with-docker-cp/)
- [GHSA-hfg8-hc9c-6c3h: moby/go-archive tar extraction fails to confine writes](https://github.com/moby/go-archive/security/advisories/GHSA-hfg8-hc9c-6c3h)
- [CVE-2026-17106 - Wiz Vulnerability Database](https://www.wiz.io/vulnerability-database/cve/cve-2026-17106)
- [CVE-2026-17106: moby/go-archive Symlink-Following Path Traversal in Tar Extraction](https://securelayer7.net/lab/cve-2026-17106-moby-go-archive-symlink-tar-path-traversal)
- [CVE-2026-17106: Docker docker cp Container-to-Host Arbitrary File Write](https://thecybersecguru.com/news/copyescape-cve-2026-17106-docker-cp/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-2812