## https://sploitus.com/exploit?id=DB5ED973-240B-5C9A-A9F6-F0834C9CCC9C
# CVE-2026-17106 – Vulnerability in “docker cp” allowing arbitrary file writing to any file on the host
>HackSpeak distributes this image. **This repository contains the CopyEscape PoC (CVE-2026-17106) distributed by Imperva’s Red Team (Ron Masas). The code is consistent with the upstream source. The upstream source does not include a license. The image uses the **MIT License**, Copyright © 2026 HackSpeak**. The source code remains under the copyright of its original author.**
> ⚠️ **This image is intended only for security research and authorized testing purposes**. In the Linux demonstration, `/usr/bin/runc` is being overwritten. Please run it in a temporary VM and create a verifiable backup before execution. Do not execute it in an unauthorized or production environment. ## Description of the vulnerability
**CopyEscape(CVE-2026-17106)** is a vulnerability in Docker’s “docker cp” command (and Docker Sandboxes’ “sbx cp”) that allows arbitrary file writing to any file on the host. This vulnerability was discovered by Imperva’s Red Team (Ron Masas).
- **Mechanism**: “docker cp” does not perform direct file system copying. The daemon generates a tar archive using “filepath.WalkDir” on the container’s file system. The CLI receives the tar archive and decompresses it on the client side.
- **Bug 1 (TOCTOU race condition at the archive generation stage)**: The daemon locks the container object state but does not freeze the processes inside the container. During the walking process, processes can replace directories with **absolute symbolic links**. This causes “addTarFile” to see a symlink instead of the actual directory during the Lstat operation, resulting in inconsistent entries in the tar archive (first the symlink header, then the “subfile” entry).
- **Bug 2 (Symbolic link handling during extraction)**: When extracting the archive, the constructed path is checked for boundaries. However, **the actual os.Symlink call uses the unchecked original Linkname parameter**, which can point to an absolute path. Subsequently, when extracting subfiles, the kernel follows this symlink, leading to files being written outside the user-specified target.
- **Impact**: Malicious containers can induce the CLI to create/overwrite any writable file on the host with the user’s permissions. On macOS, it can overwrite shell startup scripts and persistently store data in ~/Library/LaunchAgents. On Linux, “sudo docker cp” can overwrite /usr/bin/runc, allowing root code to be executed during subsequent Docker lifecycle operations. ## Verification and fixing versions
- **Verification versions**: Docker Engine/CLI **29.6.1**, Docker Desktop **4.81.0**.
- **Fixing versions**: Docker Engine/CLI **29.7.2**, Docker Desktop **4.86.0**, Docker Sandboxes **0.38.0** (2026-08-06).
- **Temporary mitigation**: Stop the container before copying to avoid using “sudo docker cp” on untrusted containers. ## Usage
Two demonstrations (consistent with the official version): Engine 29.6.1 / Desktop 4.81.0:
**macOS (Non-destructive, creating `~/pwnd`)**
```console
cd macos
./demo-macos.sh
```
**Linux (High impact, overwriting /usr/bin/runc)**:
```console
cd linux
# Build and run the image according to the instructions below. ⚠️ Make sure to back up /usr/bin/runc before overwriting it.
```
>For more details, refer to the documentation in the `macos/` and `linux/` directories in this repository. ## Disclaimer
- **This image is intended only for security research, vulnerability verification, and defensive testing purposes**. Please run it in a isolated environment. Do not use it on unauthorized systems.
- In the Linux demonstration, the key binary on the host (/usr/bin/runc) is being overwritten. Please run it in a temporary VM and make a backup. ## Reference links
- **Upstream source repository (source of this PoC)**: https://github.com/masasron/CopyEscape-CVE-2026-17106
- Imperva’s official blog: CopyEscape: Taking Over Docker Hosts with “docker cp” — https://www.imperva.com/blog/copyescape-taking-over-docker-hosts-with-docker-cp/
- Related reports: 360 Vulnerabilities Research Institute confirmed that CVE-2026-17106 has been reproduced.