CopyEscape Docker Flaw Lets Malicious Containers Overwrite Host Files and Gain Root Access

CVE-2026-17106 (“CopyEscape”) is a destination-escape flaw in Docker’s archive handling (moby/go-archive) where a TOCTOU race and improper link resolution let a malicious container craft a tar that causes docker cp (or sbx cp) to write files outside the chosen destination; attackers can overwrite host files and potentially achieve root-level code execution. Docker Desktop 4.86.0 and moby/go-archive 0.3.0 contain fixes; mitigations include avoiding docker cp on running/untrusted containers, stopping containers before copying, and removing elevated privileges from collection jobs.