PT-2026-65847 · Unknown · Proot-Distro

CVE-2026-54574 · Published 2026-07-29 · Updated 2026-07-29

Positive Technologies (AI Summary)

CVSS v3.1

8.2

High

Base vector

AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions proot-distro versions prior to 5.1.5

Description proot-distro fails to validate archive-controlled symlink targets when extracting root filesystems. While the software rejects tar member names containing .. components to prevent directory traversal, it does not perform equivalent checks on symlink targets (member.linkname). A malicious archive can plant a symlink pointing to an absolute host path, allowing subsequent files to be written directly onto the host filesystem at the privilege level of the process. This issue occurs during the installation or reset process and affects the extract plain tar() function in proot distro/commands/install.py and the apply layer() function in proot distro/helpers/docker.py.

Recommendations Update proot-distro to version 5.1.5. As a temporary workaround, avoid installing root filesystems from untrusted or unverified tarball archives. Restrict the use of the extract plain tar() and apply layer() functions when processing archives from unknown sources.

Exploit

Fix

Weakness Enumeration

CWE-61

Related Identifiers

CVE-2026-54574

GHSA-9XQ3-3FQG-4VG7

Affected Products

Proot-Distro

References · 6

• 🔥 https://github.com/termux/proot-distro/security/advisories/GHSA-9xq3-3fqg-4vg7 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-54574 · Security Note
• https://osv.dev/vulnerability/GHSA-9xq3-3fqg-4vg7 · Vendor Advisory
• https://github.com/termux/proot-distro/commit/a96d7a9667f38e45d812614852ee3915d1c0ae45 · Note
• https://github.com/termux/proot-distro/releases/tag/v5.1.5 · Note
• https://github.com/termux/proot-distro · Note