CVE-2026-17106 — CopyEscape:docker cp container-to-host arbitrary file write

HackSpeak distribution mirror. This repository is a distribution mirror of the CopyEscape PoC (CVE-2026-17106) published by the Imperva Red Team (Ron Masas), with the code identical to upstream; upstream does not include a LICENSE, so this mirror follows distribution convention and adopts MIT License, Copyright (c) 2026 HackSpeak, with source code copyright belonging to the original author.

⚠️ For authorized security research and testing only; the Linux demo will overwrite /usr/bin/runc, so run it in a disposable VM and make a verifiable backup first; do not run it in unauthorized or production environments.

Vulnerability Overview

CopyEscape (CVE-2026-17106) is a container-to-host arbitrary file write vulnerability in Docker docker cp (and sbx cp in Docker Sandboxes), discovered by the Imperva Red Team (Ron Masas).

• Mechanism: docker cp is not a direct filesystem copy — the daemon runs filepath.WalkDir on the container filesystem to produce a tar archive, and the CLI receives the tar and extracts it on the client side;
• Flaw 1 (archive-side TOCTOU race): the daemon locks the container object's state but does not freeze processes inside the container; a process inside the container can replace a directory with an absolute symlink during the walk, so that when addTarFile Lstat's it again it sees a symlink → the tar stream contains inconsistent entries (a symlink header followed by "child file" entries);
• Flaw 2 (extraction-side symlink handling): during extraction, the constructed path after filepath.Join is boundary-checked, but the actual os.Symlink call uses the raw, unchecked hdr.Linkname (which can point to an absolute path); when subsequent child files are extracted, the kernel follows the symlink and writes outside the user-specified destination;
• Impact: a malicious container can trick the CLI into creating/overwriting arbitrary writable files on the host with the privileges of the user running docker cp. On macOS it can overwrite shell startup scripts and persist via ~/Library/LaunchAgents; on Linux, using sudo docker cp can overwrite /usr/bin/runc, and subsequent Docker lifecycle operations then achieve root code execution.

Verified and Fixed Versions

• Verified versions: Docker Engine/CLI 29.6.1, Docker Desktop 4.81.0;
• Fixed versions: Docker Engine/CLI 29.7.2, Docker Desktop 4.86.0, Docker Sandboxes 0.38.0 (2026-08-06);
• Temporary mitigation: stop the container before copying; avoid using sudo docker cp with untrusted containers.

Usage

Two demos (test environment matches the official one: Engine 29.6.1 / Desktop 4.81.0):

macOS (non-destructive, creates ~/pwnd)

cd macos
./demo-macos.sh

Linux (high impact, overwrites /usr/bin/runc)

cd linux
# 按 linux/ 内说明构建镜像并运行;⚠️ 覆盖 runc 前务必备份

For detailed steps, see the instruction files in the macos/ and linux/ subdirectories of this repository.

Disclaimer

• For security research, vulnerability validation, and defensive testing only; run it in an isolated environment and never use it against unauthorized systems;
• The Linux demo overwrites a critical host binary (/usr/bin/runc) and must be run in a disposable VM with a backup.

References

• Upstream source repository (source of this PoC): https://github.com/masasron/CopyEscape-CVE-2026-17106
• Imperva official blog: CopyEscape: Taking Over Docker Hosts with docker cp — https://www.imperva.com/blog/copyescape-taking-over-docker-hosts-with-docker-cp/
• Related coverage: 360 Vulnerability Research Institute confirms reproduction (CVE-2026-17106)