GHSA-MFR4-MQ8W-VMG6: Path Traversal in proot-distro copy Command Allows Container Escape
Vulnerability ID: GHSA-MFR4-MQ8W-VMG6
CVSS Score: 7.3
Published: 2026-07-17
A directory traversal vulnerability exists in the copy subcommand of the proot-distro utility. Due to incomplete path sanitization, local attackers or malicious scripts can read from or write to arbitrary files outside the container rootfs, bypassing isolation barriers and potentially gaining unauthorized access or persistent execution on the host system.
TL;DR
A path traversal flaw in proot-distro prior to version 5.1.0 allows attackers to escape container directory limits and read or write arbitrary host files via the copy command.
⚠️ Exploit Status: POC
Technical Details
- CWE ID: CWE-22
- Attack Vector: Local
- CVSS v3.1 Score: 7.3
- Exploit Status: PoC (Proof of Concept)
- Impact: Arbitrary File Read & Write
- KEV Status: Not Listed
Affected Systems
- proot-distro (Termux Packages)
- proot-distro Python packages
-
proot-distro: < 5.1.0 (Fixed in:
5.1.0)
Mitigation Strategies
- Upgrade proot-distro to version 5.1.0 or newer immediately.
- Audit existing shell configuration profiles for unauthorized modifications.
- Avoid running untrusted scripts or setup files inside outdated proot environments.
Remediation Steps:
- To update proot-distro using Termux's native package manager, execute: pkg upgrade proot-distro
- To update proot-distro when installed via pip, execute: pip install --upgrade proot-distro
- Verify the installed version is 5.1.0 or higher by executing: proot-distro --help or checking package listings.
- Inspect configuration profiles such as ~/.bashrc, ~/.profile, and ~/.bash_profile for unauthorized scripts or command blocks.
References
Read the full report for GHSA-MFR4-MQ8W-VMG6 on our website for more details including interactive diagrams and full exploit analysis.
Top comments (0)