Docker CopyEscape Vulnerability Enables Host File Overwrite and Root Code Execution

Gbhackers •Divya • August 12, 2026

A critical vulnerability in Docker, tracked as CVE-2026-17106 and referred to as “CopyEscape,” allows malicious containers to overwrite files on the host system using the widely utilized `docker cp` command. This flaw can lead to code execution as the local user and, potentially, as root on Linux systems where copy operations are performed with elevated […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Critical Docker Vulnerability CVE-2026-17106 Allows Host File Overwrite A critical vulnerability in Docker, identified as CVE-2026-17106 and dubbed 'CopyEscape', has been disclosed. This flaw allows malicious containers to overwrite files on the host system using the 'docker cp' command, potentially leading to code execution with the privileges of the user running the command. The vulnerability affects systems running Docker Engine, Docker CLI, Docker Desktop, and Docker Sandboxes. Public proof-of-concept exploit code has been released, raising concerns about active exploitation. Affected organizations are urged to update to the latest versions of Docker to mitigate risks. The flaw was discovered by the Imperva Red Team and is linked to unsafe symlink handling during extraction. Successful exploitation could compromise developer accounts or achieve root access. Security updates have been released to address this vulnerability. 4 sources 73

Extracted Entities

Docker CopyEscape Vulnerability Enables Host File Overwrite and Root Code Execution

The full story

Extracted Entities

CVEs (1)

Platforms (1)

Tools (1)

Vulnerabilities (1)