PT-2026-65856 · Unknown · Proot-Distro

CVE-2026-54727 · Published 2026-07-29 · Updated 2026-07-29

Positive Technologies (AI Summary)

CVSS v3.1

8.2

High

Base vector

AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions proot-distro versions prior to 5.1.6

Description proot-distro is a utility for managing proot containers. The restore command fails to verify that the hardlink source container matches the destination container being restored. When processing a crafted backup archive, the utility resolves the hardlink source from the linkname field and copies the referenced file into the destination container. While path traversal protections prevent access outside the containers directory, the lack of container-to-container validation allows a malicious archive to copy files between otherwise isolated containers. This can lead to cross-container file disclosure, such as the exposure of SSH private keys, API credentials, and configuration secrets, as well as cross-container file injection.

Recommendations Update proot-distro to version 5.1.6 or later. As a temporary mitigation, avoid using the restore command with backup archives from untrusted sources.

Exploit

Fix

Exposure of Resource to Wrong Sphere

Weakness Enumeration

CWE-668

Related Identifiers

CVE-2026-54727

GHSA-7H3G-4W2F-FJ2F

Affected Products

Proot-Distro

References · 6

• 🔥 https://github.com/termux/proot-distro/security/advisories/GHSA-7h3g-4w2f-fj2f · Exploit
• https://osv.dev/vulnerability/GHSA-7h3g-4w2f-fj2f · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-54727 · Security Note
• https://github.com/termux/proot-distro/releases/tag/v5.1.6 · Note
• https://github.com/termux/proot-distro/commit/98aff324b7d8500ff75a8ca9ac087ee636be4716 · Note
• https://github.com/termux/proot-distro · Note