Is This vulnerability exploited in the wild?

No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.

How severe is This vulnerability?

Medium severity, with a CVSS score of 6.6, published 17 July 2026.

Is there a fix for This vulnerability?

A patch was published on 2026-06-06: Version 5.1.0 released to address the issue Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is This vulnerability attacked?

It is attacked with local access, in a network appliance.

Check whether you run proot-distro (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Termux proot-distro path traversal in copy command

Severity: medium · CVSS 6.6 · Published 2026-07-17

A vulnerability in the Termux proot-distro utility allows an attacker to read or write files outside of the intended isolated container environment. By tricking a user or a script into using a specially crafted file path, an attacker could steal sensitive data like SSH keys or gain persistent control over the Termux application by modifying startup files. This could lead to unauthorized access to the user's local files and persistent execution of malicious code.

Technologies: proot-distro (PyPI). Vendors: PyPI.

Quick answers

Is This vulnerability exploited in the wild?: No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.
How severe is This vulnerability?: Medium severity, with a CVSS score of 6.6, published 17 July 2026.
Which products and versions are affected?: proot-distro (PyPI) < 5.1.0.
Is there a fix for This vulnerability?: A patch was published on 2026-06-06: Version 5.1.0 released to address the issue Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is This vulnerability attacked?: It is attacked with local access, in a network appliance.
Am I affected?: Check whether you run proot-distro (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A path traversal vulnerability (CWE-22) exists in the 'proot-distro copy' command due to insufficient validation of container-relative paths. By using parent directory references (e.g., '../../'), an attacker can escape the container's root filesystem to access the host Termux environment. This allows for arbitrary file reads (exfiltration of credentials) and writes (overwriting .bashrc for persistent code execution). The vulnerability is exploitable if a user or automated tool processes untrusted path input via the CLI. A fix is available in version 5.1.0 which implements canonical path verification to ensure resolved paths remain within the rootfs boundary.

Affected products

Termux proot-distro < 5.1.0

Timeline

2026-05-19: other: Vulnerability confirmed on version 5.0.2
2026-06-06: patched: Version 5.1.0 released to address the issue
2026-07-17: advisory: GitHub Advisory GHSA-mfr4-mq8w-vmg6 published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.