CVE-2018-15664: In Docker through 18.06.1-ce-rc2, the API endpoints behind the 'docker cp' command are vulnerable to a syml...

Security readout for executives and security teams

Docker’s file copy feature could be tricked into following a swapped symlink and touching files on the host. In the worst case, an attacker with the right container interaction could gain root-level read-write access to the host filesystem. This is a serious container escape-style issue, but the bundle does not show active exploitation. Exposure is most likely on Docker or Moby installations covered by the CVE and vendor advisories, especially shared hosts, CI runners, build systems, and environments where users copy files to or from untrusted containers. Prioritize remediation on shared Docker hosts and CI infrastructure. The business risk is host compromise from a container file-copy operation, with potential impact to secrets, source code, workloads, and adjacent systems. Mitigation focus: Apply Docker, Moby, or distribution updates referenced by vendor advisories.; Check Moby PR 39252 and vendor guidance for fixed package lineage.; Restrict access to the Docker daemon socket and remote API..

Prepared

Jun 6, 2026, 20:55 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.