CVE-2026-54574: Symlink Escape and Arbitrary Host File Write in proot-distro

The utility proot-distro manages rootless PRoot containers on Termux and other Linux installations. During the extraction of tar archives—such as when installing containers, parsing Docker/OCI layers, or restoring backup archives—the application unpacks files into a dedicated target root directory (the container's rootfs). To prevent directory traversal, proot-distro sanitizes incoming member filenames, stripping leading slashes and discarding paths with traversal sequences like ...

However, a critical asymmetric validation flaw exists in versions prior to 5.1.5. Although the destination filenames are verified, the targets of symbolic links (member.linkname) are not validated. This permits an archive to plant a symlink pointing to an absolute or relative directory on the host filesystem.

When subsequent files inside the archive are extracted beneath the name of the symlink, the application resolves the path through the symlink. This results in file creation or modification directly on the host system outside the boundaries of the container's rootfs.

The root cause of this vulnerability lies in how Python's standard tarfile module interacts with symbolic links during sequential extraction when there is no runtime containment. In affected versions, the application processes directory traversal checks purely lexically on the member name, which fails to account for stateful changes on the filesystem during the extraction process.

If an archive contains a symlink member named evil targeting a host directory such as /data/data/com.termux/files/home, the extraction routine creates this symlink at <rootfs_dir>/evil. If a subsequent archive member is named evil/.bashrc, the destination path is generated using os.path.join(rootfs_dir, 'evil/.bashrc').

To write this regular file, the application invokes os.makedirs(os.path.dirname(dest), exist_ok=True) to create any parent directories. Because evil is already a symlink pointing to the host directory, the host operating system's filesystem APIs resolve the link. Consequently, open(dest, 'wb') is executed against /data/data/com.termux/files/home/.bashrc, writing the malicious content directly to the host filesystem.

The fix introduced in version 5.1.5 refactors the extraction logic in proot_distro/helpers/tar_extract.py by introducing a component-by-component path resolver named _safe_resolve(). This routine checks and clamps symlinks as they are evaluated.

def _safe_resolve(root, parts):
    resolved: list = []
    pending = list(parts)
    link_budget = 40
    while pending:
        comp = pending.pop(0)
        if comp in ("", "."):
            continue
        if comp == "..":
            if resolved:
                resolved.pop()
            continue
        current = os.path.join(root, *resolved, comp)
        try:
            st = os.lstat(current)
        except OSError:
            # Path does not exist yet; safe to append verbatim
            resolved.append(comp)
            continue
        if stat.S_ISLNK(st.st_mode):
            link_budget -= 1
            if link_budget < 0:
                return None
            try:
                target = os.readlink(current)
            except OSError:
                return None
            tparts = target.split("/")
            if target.startswith("/"):
                resolved = []  # Re-root at container rootfs
            pending[:0] = tparts
        else:
            resolved.append(comp)
    return os.path.join(root, *resolved)

The patched engine applies _safe_resolve to the parent directories of each member during extraction. If a symbolic link points to an absolute path, the resolved stack is cleared, forcing the path resolution to restart from the container's rootfs. Hard link extraction is also deferred until after all regular files are fully written to avoid race conditions.

Exploitation requires an attacker to supply a crafted tar archive, container image, or backup to a victim who then runs proot-distro install or proot-distro restore with the malicious input. No special privileges are required.

When the victim runs the installation command, the symlink is written to disk. The subsequent file member is then written through the symlink, placing a payload inside the host's terminal configuration. The payload executes the next time the victim opens a Termux shell session.

The vulnerability has been assigned a CVSS v3.1 score of 8.2 (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N). The scope metric is set to Changed (S:C) because the exploit bypasses the container runtime boundaries to alter files on the host system.

The concrete impact is dictated by the privileges of the executing process. In Termux, which runs within a single Android user context, an attacker can modify local shell environment files, compromising the terminal session and potentially accessing stored keys or credentials. In general Linux systems, running the extraction process as root allows the attacker to compromise the entire operating system by writing to /etc/shadow or creating systemd services.

To address this vulnerability, users must upgrade to proot-distro version 5.1.5 or later. The update introduces the _safe_resolve logic to trap symlinks inside the container's root directory.

If upgrading is not immediately possible, users should enforce the following temporary workarounds:

1. Avoid installing or restoring container archives from unverified or third-party sources.

2. Avoid running proot-distro operations as the root user.

3. Use tar -tvf <archive> to inspect the contents of any external archive and verify that it does not contain absolute symlinks or suspicious targets prior to installation.