{"vulnerability": "cve-2026-54574", "sightings": [{"uuid": "d87a4c27-4878-4b26-86f6-c33befcd6228", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-54574", "type": "seen", "source": "https://gist.github.com/alon710/3dfab3b451ecd01d7d3ac084db088fec", "content": "# CVE-2026-54574: CVE-2026-54574: Symlink Escape and Arbitrary Host File Write in proot-distro\n\n> **CVSS Score:** 8.2\n> **Published:** 2026-07-29\n> **Full Report:** https://cvereports.com/reports/CVE-2026-54574\n\n## Summary\nCVE-2026-54574 (GHSA-9xq3-3fqg-4vg7) is a critical Symlink Escape and Arbitrary Host File Write vulnerability in proot-distro, an open-source utility for managing rootless PRoot containers on Termux and general Linux environments. The vulnerability is rooted in an asymmetric validation flaw during the archive extraction process of container installations, Docker/OCI layers, and container backup restorations. While the extraction engine successfully validated file names to prevent standard directory traversal (e.g., rejecting components containing '..'), it failed to validate symbolic link targets. An attacker could craft a malicious tar archive or container image that plants an absolute host-path symlink. Subsequent file members within the same archive could then traverse through this symlink, writing arbitrary files directly onto the host filesystem under the privileges of the executing process.\n\n## TL;DR\nAn asymmetric path validation flaw in proot-distro prior to version 5.1.5 allows arbitrary host filesystem writes when extracting a malicious container image or backup archive containing crafted symbolic links.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-59 (Improper Link Resolution Before File Access)\n- **Attack Vector**: Local (AV:L)\n- **CVSS Score**: 8.2\n- **Exploit Status**: Proof of Concept available\n- **KEV Status**: Not listed\n- **Affected Product**: proot-distro\n- **Fixed Version**: 5.1.5\n\n## Affected Systems\n\n- Termux environments running proot-distro versions prior to 5.1.5\n- Linux systems using proot-distro versions prior to 5.1.5\n- **proot-distro**: < 5.1.5 (Fixed in: `5.1.5`)\n\n## Mitigation\n\n- Upgrade proot-distro to version 5.1.5 or newer.\n- Avoid importing, installing, or restoring untrusted container images or backups.\n- Run proot-distro with the minimum necessary privileges to restrict the impact of potential escapes.\n\n**Remediation Steps:**\n1. Check the currently installed version of proot-distro.\n2. Run 'pkg upgrade proot-distro' in Termux or pull the latest release from the repository.\n3. Verify that the active version is 5.1.5 or higher.\n4. Audit existing container directories for rogue symbolic links using search utilities.\n\n## References\n\n- [GitHub Security Advisory GHSA-9xq3-3fqg-4vg7](https://github.com/termux/proot-distro/security/advisories/GHSA-9xq3-3fqg-4vg7)\n- [Fix Commit: _safe_resolve Implementation](https://github.com/termux/proot-distro/commit/a96d7a9667f38e45d812614852ee3915d1c0ae45)\n- [Merge Commit: Path Resolution Fix](https://github.com/termux/proot-distro/commit/527e5f0fcdc6ef94d765e2ba990939a62fcca272)\n- [Unit and Security Tests Commit](https://github.com/termux/proot-distro/commit/722ef50d8b14bbeaaa6061d6e9d46735cb321247)\n- [proot-distro Version 5.1.5 Release](https://github.com/termux/proot-distro/releases/tag/v5.1.5)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-54574) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-07-30T01:32:06.457249Z"}, {"uuid": "079d1f0e-ea3f-449a-b68d-8dd0121d1f29", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-54574", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mrsih6ubzv2j", "content": "CVE-2026-54574 - `proot-distro install` has a Symlink Escape (Arbitrary Host File Write) via Malicious Tar Archive\nCVE ID : CVE-2026-54574\n \n Published : July 29, 2026, 5:16 p.m. | 27\u00a0minutes ago\n \n Description : proot-distro is a utility for managing proot containers. Prior t...", "creation_timestamp": "2026-07-29T17:51:20.145790Z"}, {"uuid": "bd1ac810-32ae-4c02-9791-f22f2edd0f83", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-54574", "type": "published-proof-of-concept", "source": "https://github.com/termux/proot-distro/security/advisories/GHSA-9xq3-3fqg-4vg7", "content": "", "creation_timestamp": "2026-07-29T18:35:11.258918Z"}]}