# CVE-2026-54727: Termux proot-distro container isolation bypass in restore command

Source: https://junglewise.ai/threats/cve-2026-54727-termux-proot-distro-container-isolation-bypass-in-restore-command  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-29. Updated: 2026-07-29  
License: CC BY 4.0 with a link back

CVE-2026-54727 · Severity: high · CVSS 8.2 · Published 2026-07-29

proot-distro is a utility used to manage and run Linux distributions within the Termux environment on Android. A security flaw in the backup restoration process allows a specially crafted archive to bypass the isolation between different installed containers. If a user is tricked into restoring a malicious backup file, an attacker could steal sensitive data (such as SSH keys or credentials) from other containers or inject malicious files into them, potentially compromising the integrity of the user's entire container environment.

Technologies: [proot-distro (PyPI)](https://junglewise.ai/threats/technologies/proot-distro). Vendors: [PyPI](https://junglewise.ai/threats/vendors/pypi).

## Quick answers

**Is CVE-2026-54727 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-54727 being exploited in the wild.

**How severe is CVE-2026-54727?** High severity, with a CVSS score of 8.2, published 29 July 2026.

**Which products and versions are affected?** proot-distro (PyPI) <= 5.1.5, ECOSYSTEM:introduced=0,fixed=5.1.6.

**Is there a fix for CVE-2026-54727?** Yes. proot-distro (PyPI): upgrade to 5.1.6 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-54727 attacked?** It is attacked with local access, in a software library.

**Am I affected by CVE-2026-54727?** Check whether you run proot-distro (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- proot-distro (PyPI): upgrade to 5.1.6 or later

  ```sh
  pip install "proot-distro>=5.1.6"
  ```


## Technical details

A container isolation bypass exists in proot-distro's 'restore' command due to improper validation of hardlink entries within backup archives. While the utility implements path traversal protections to keep operations within the containers directory, it fails to verify that a hardlink's source container matches the destination container being restored. An attacker can craft a TAR archive containing hardlink entries where the 'linkname' references the root filesystem of a different installed container. When a user restores this archive, the utility will copy files from the targeted 'victim' container into the 'attacker' container (disclosure) or vice versa (injection). This vulnerability is classified under CWE-668 and was addressed in version 5.1.6 by ensuring hardlink sources are restricted to the container currently being processed.

## Affected products

- termux proot-distro < 5.1.6

## Identifiers

- CVE-2026-54727
- GHSA-7h3g-4w2f-fj2f
- PYSEC-2026-3607

## Timeline

- 2026-06-09: patched: Version 5.1.6 released
- 2026-06-10: advisory: GitHub Security Advisory published
- 2026-07-29: disclosed: CVE published to NVD

## References

- [https://github.com/termux/proot-distro/commit/98aff324b7d8500ff75a8ca9ac087ee636be4716](https://github.com/termux/proot-distro/commit/98aff324b7d8500ff75a8ca9ac087ee636be4716)
- [https://github.com/termux/proot-distro/releases/tag/v5.1.6](https://github.com/termux/proot-distro/releases/tag/v5.1.6)
- [https://github.com/termux/proot-distro/security/advisories/GHSA-7h3g-4w2f-fj2f](https://github.com/termux/proot-distro/security/advisories/GHSA-7h3g-4w2f-fj2f)

## Related threats

- [termux proot-distro symlink escape in archive extraction](https://junglewise.ai/threats/cve-2026-54574-termux-proot-distro-symlink-escape-in-archive-extraction)
- [Termux proot-distro path traversal in copy command](https://junglewise.ai/threats/termux-proot-distro-path-traversal-in-copy-command-114d35b8)