CVE-2026-54727: Container Isolation Bypass in proot-distro via Malicious Restore Archive
Vulnerability ID: CVE-2026-54727
CVSS Score: 8.2
Published: 2026-07-29
A container isolation bypass vulnerability exists in proot-distro prior to version 5.1.6. The utility accepted hardlink entries pointing outside the container directory being restored, allowing cross-container file read and write capabilities.
TL;DR
A container boundary bypass in proot-distro allows a malicious restore archive to read or write files inside other isolated containers on the device.
⚠️ Exploit Status: POC
Technical Details
- CWE ID: CWE-668
- Attack Vector: Local
- CVSS Score: 8.2 (High)
- Impact: Cross-container read and write access
- Exploit Status: Proof-of-Concept
- KEV Status: Not Listed
Affected Systems
- proot-distro
-
proot-distro: < 5.1.6 (Fixed in:
5.1.6)
Code Analysis
Commit: 98aff32
Enforce single-container extraction limits and restrict hardlink resolution targets inside the active container directory
Commit: 6f73f98
Ensure atomic verification of rootfs locations before filesystem writes are performed
Commit: 50cba9f
Enforce validation to confirm a real directory was extracted at the rootfs destination path
Commit: eb1dbf8
Update container name regex pattern validation to use end-of-string anchor \Z
Exploit Details
- GitHub Security Advisory: Details the logical flaw concerning hardlink destination validation inside rootless container environments.
Mitigation Strategies
- Keep proot-distro updated to the latest version via Termux package management
- Do not restore unauthenticated, third-party, or untrusted container backup archives
- Enforce static analysis or pre-extraction checks on backup tarballs
Remediation Steps:
- Execute 'pkg update && pkg upgrade proot-distro' to upgrade to v5.1.6 or later
- Audit any existing container layouts or verify nested hardlink/symlink properties
- Configure automated package scanners to flag outdated variants of proot-distro
References
Read the full report for CVE-2026-54727 on our website for more details including interactive diagrams and full exploit analysis.
Top comments (0)