DEV Community

CVE Reports
CVE Reports

Posted on • Originally published at cvereports.com

CVE-2026-54574: CVE-2026-54574: Symlink Escape and Arbitrary Host File Write in proot-distro

#security #cve #cybersecurity

CVE-2026-54574: Symlink Escape and Arbitrary Host File Write in proot-distro

Vulnerability ID: CVE-2026-54574
CVSS Score: 8.2
Published: 2026-07-29

CVE-2026-54574 (GHSA-9xq3-3fqg-4vg7) is a critical Symlink Escape and Arbitrary Host File Write vulnerability in proot-distro, an open-source utility for managing rootless PRoot containers on Termux and general Linux environments. The vulnerability is rooted in an asymmetric validation flaw during the archive extraction process of container installations, Docker/OCI layers, and container backup restorations. While the extraction engine successfully validated file names to prevent standard directory traversal (e.g., rejecting components containing '..'), it failed to validate symbolic link targets. An attacker could craft a malicious tar archive or container image that plants an absolute host-path symlink. Subsequent file members within the same archive could then traverse through this symlink, writing arbitrary files directly onto the host filesystem under the privileges of the executing process.

TL;DR

An asymmetric path validation flaw in proot-distro prior to version 5.1.5 allows arbitrary host filesystem writes when extracting a malicious container image or backup archive containing crafted symbolic links.

⚠️ Exploit Status: POC

Technical Details

  • CWE ID: CWE-59 (Improper Link Resolution Before File Access)
  • Attack Vector: Local (AV:L)
  • CVSS Score: 8.2
  • Exploit Status: Proof of Concept available
  • KEV Status: Not listed
  • Affected Product: proot-distro
  • Fixed Version: 5.1.5

Affected Systems

  • Termux environments running proot-distro versions prior to 5.1.5
  • Linux systems using proot-distro versions prior to 5.1.5
  • proot-distro: < 5.1.5 (Fixed in: 5.1.5)

Code Analysis

Commit: a96d7a9

Implement _safe_resolve to secure symlink parent directory lookups during extraction

Commit: 527e5f0

Merge pull request fixing path resolution and symlink escape vulnerabilities

Commit: 722ef50

Add security regression tests verifying directory containment

Mitigation Strategies

  • Upgrade proot-distro to version 5.1.5 or newer.
  • Avoid importing, installing, or restoring untrusted container images or backups.
  • Run proot-distro with the minimum necessary privileges to restrict the impact of potential escapes.

Remediation Steps:

  1. Check the currently installed version of proot-distro.
  2. Run 'pkg upgrade proot-distro' in Termux or pull the latest release from the repository.
  3. Verify that the active version is 5.1.5 or higher.
  4. Audit existing container directories for rogue symbolic links using search utilities.

References

Read the full report for CVE-2026-54574 on our website for more details including interactive diagrams and full exploit analysis.

Top comments (0)