Executive brief
proot-distro is a utility used to manage Linux distributions within a container-like environment on Android. A security flaw allows a specially crafted container image or archive to break out of its intended directory and write files directly onto the user's device. If a user attempts to install a malicious archive, an attacker could gain persistent control over the user's terminal environment by overwriting sensitive configuration files.
Technical details
A symlink escape vulnerability exists in proot-distro's archive extraction logic within `_extract_plain_tar()` and `_apply_layer()`. While the utility validated member names for directory traversal (e.g., '..'), it failed to validate the `linkname` property of symbolic link members. An attacker can craft a tar archive containing a symlink pointing to an absolute host path, followed by a regular file member that traverses that symlink. During extraction, Python's `os.symlink` creates the link, and subsequent `open()` calls follow it, resulting in an arbitrary file write on the host at the privilege level of the Termux process. This is fixed in version 5.1.5 by implementing a secure path resolver that clamps all symlink hops within the container rootfs.
Affected products
- termux proot-distro < 5.1.5
Timeline
- 2026-06-06: patched: Fix committed to repository
- 2026-06-07: patched: Version 5.1.5 released
- 2026-06-08: advisory: GitHub Security Advisory published
- 2026-07-29: disclosed: CVE published to NVD