Destination-escape is a file-handling flaw where extracted content is written outside the directory that the operator or application intended. It usually happens during archive extraction or copy-out workflows when path validation fails and a crafted filename, symlink, or traversal sequence changes the write target. Instead of landing in the chosen folder, the file can overwrite another location on the same filesystem.
In cyber security, this matters because it turns a routine transfer into an integrity risk. An attacker who controls the source data may be able to replace configuration files, drop payloads, or interfere with automation on a host or build agent. Defenders reduce the risk by treating archives as untrusted input, normalizing paths before write, rejecting absolute or parent-relative paths, checking symlink behavior, and applying least privilege. In tools like container copy or artifact extraction features, destination-escape bugs are especially dangerous because users expect a simple file transfer, not host-side writes.