Executive brief
A vulnerability in the Termux proot-distro utility allows an attacker to read or write files outside of the intended isolated container environment. By tricking a user or a script into using a specially crafted file path, an attacker could steal sensitive data like SSH keys or gain persistent control over the Termux application by modifying startup files. This could lead to unauthorized access to the user's local files and persistent execution of malicious code.
Technical details
A path traversal vulnerability (CWE-22) exists in the 'proot-distro copy' command due to insufficient validation of container-relative paths. By using parent directory references (e.g., '../../'), an attacker can escape the container's root filesystem to access the host Termux environment. This allows for arbitrary file reads (exfiltration of credentials) and writes (overwriting .bashrc for persistent code execution). The vulnerability is exploitable if a user or automated tool processes untrusted path input via the CLI. A fix is available in version 5.1.0 which implements canonical path verification to ensure resolved paths remain within the rootfs boundary.
Affected products
- Termux proot-distro < 5.1.0
Timeline
- 2026-05-19: other: Vulnerability confirmed on version 5.0.2
- 2026-06-06: patched: Version 5.1.0 released to address the issue
- 2026-07-17: advisory: GitHub Advisory GHSA-mfr4-mq8w-vmg6 published