What is the CVSS score of CVE-2026-54574?

CVE-2026-54574 has a CVSS 3.1 base score of 8.2 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N. EPSS exploitation probability: 0.1%.

Which versions of proot-distro are affected by CVE-2026-54574?

A critical vulnerability in termux/proot-distro before version 5.1.5 allows arbitrary file writes to the host filesystem during container installation through malicious rootfs tarballs or Docker…. A patch is available.

Is there a public PoC exploit available for CVE-2026-54574?

Yes, a public proof-of-concept exploit is available for CVE-2026-54574. Prioritise patching immediately. EPSS: 0.1%.

How to fix or mitigate CVE-2026-54574?

Within 24 hours, audit your environment to identify all proot-distro installations and verify they are running version 5.1.5 or later, then implement a temporary halt on installations from external or untrusted sources. Within 7 days, enforce strict image validation controls: restrict proot-distro installs exclusively to pre-approved, digitally-signed container sources; verify cryptographic checksums on all rootfs tarballs and Docker layers before installation; implement filesystem permissions and SELinux/AppArmor policies to restrict where proot-distro can write files. Within 30 days, establish persistent monitoring for proot-distro installation activities, maintain vigilant vendor monitoring for patches to proot-distro 5.1.5 or later, and document approved image sources with cryptographic validation signatures.

proot-distro CVE-2026-54574

EUVD-2026-50408 HIGH

UNIX Symbolic Link (Symlink) Following (CWE-61)

2026-07-29 GitHub_M

GHSA-9xq3-3fqg-4vg7

Information Disclosure Docker Proot Distro

8.2

CVSS 3.1 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

8.2 HIGH

AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N

vuln.today AI

8.2 HIGH

Local because the victim must run install on an attacker-supplied archive (AV:L/UI:R), no prior privileges needed (PR:N), and the host-filesystem write escapes the container (S:C) yielding high confidentiality/integrity impact.

3.1 AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N

4.0 AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Patch available

Jul 29, 2026 - 17:02 EUVD

Source Code Evidence Fetched

Jul 29, 2026 - 17:01 vuln.today

Analysis Generated

Jul 29, 2026 - 17:01 vuln.today

CVE Published

Jul 29, 2026 - 16:32 cve.org

HIGH 8.2

DescriptionCVE.org

proot-distro is a utility for managing proot containers. Prior to version 5.1.5, proot-distro install extracted plain tarball root filesystems through _extract_plain_tar() in proot_distro/commands/install.py and Docker layers through _apply_layer() in proot_distro/helpers/docker.py without validating archive-controlled symlink targets in member.linkname, allowing a malicious archive to plant an absolute host-path symlink and write files through it onto the host filesystem. This issue is fixed in version 5.1.5.

Articles & Coverage 1

News 3 New Docker Vulnerabilities - 3 High Severity, 1 With POC Jul 30, 2026

AnalysisAI

Arbitrary host file write in termux/proot-distro before 5.1.5 lets a malicious rootfs tarball or Docker layer plant an absolute-path symlink during proot-distro install, so a follow-up file member is written through that symlink onto the host filesystem - outside the container, before it is ever run. The install/reset paths (_extract_plain_tar) and the Docker layer path (_apply_layer) validated member names for '..' traversal but never validated symlink targets in member.linkname. No public exploit identified at time of analysis and it is not in CISA KEV, but the flaw is confirmed and fully described by the vendor GHSA advisory with vulnerable source shown.

Technical ContextAI

proot-distro is a Termux/Android utility that installs and manages proot (unprivileged chroot-like) Linux distributions by unpacking rootfs tarballs and OCI/Docker image layers into a target directory. The root cause is CWE-61 (UNIX Symbolic Link Following): the extractor honored archive-controlled symlink targets verbatim via os.symlink(member.linkname, dest) with no clamp inside the destination root. The pre-existing guard only rejected '..'/'' components in the member name (rel_parts), leaving both absolute symlink targets and traversal via linkname unchecked. Because a symlink is materialized before a later regular-file member that references its name, Python's open() follows the planted symlink and writes outside rootfs_dir. The fix introduces helpers/tar_extract.py._safe_resolve/_safe_dest, which re-resolves each destination's parent through existing symlink components while clamping every hop inside the rootfs (re-rooting absolute targets to the guest '/'), and applies the same clamped resolution to hardlink source endpoints in restore.py and build_engine/copy_step.py.

RemediationAI

Vendor-released patch: upgrade to proot-distro 5.1.5 (pip install --upgrade proot-distro, or update via your Termux package source), which adds clamped symlink/hardlink resolution (_safe_resolve/_safe_dest) across the install, reset, restore, and build-engine extraction paths - see the fix commit https://github.com/termux/proot-distro/commit/a96d7a9667f38e45d812614852ee3915d1c0ae45, advisory https://github.com/termux/proot-distro/security/advisories/GHSA-9xq3-3fqg-4vg7, and release https://github.com/termux/proot-distro/releases/tag/v5.1.5. Until upgraded, the concrete compensating control is to only install rootfs tarballs and Docker/OCI images from trusted, integrity-verified sources (verify checksums/signatures) and avoid running proot-distro install, reset, or restore on archives from untrusted third parties; if you must inspect an unknown archive, extract it inside a disposable sandbox or unprivileged container first and audit for symlink members with absolute or traversal targets (e.g. tar -tvf listing link targets). The trade-off is that source-trust vetting is manual and does not protect against a compromised upstream mirror, so upgrading to 5.1.5 is strongly preferred over the workaround.