CVE-2026-54574: proot-distro is a utility for managing proot containers. Prior to version 5.1.5, proot-distro install extracted plain tarball root filesystems through _extract_plain_tar() in proot

highCVSS 8.2CVE-2026-54574

proot-distro is a utility for managing proot containers. Prior to version 5.1.5, proot-distro install extracted plain tarball root filesystems through _extract_plain_tar() in proot_distro/commands/install.py and Docker layers through _apply_layer() in proot_distro/helpers/docker.py without validating archive-controlled symlink targets in member.linkname, allowing a malicious archive to plant an absolute host-path symlink and write files through it onto the host filesystem. This issue is fixed in version 5.1.5.

Details

Source: NVD Recent CVEs (US · database · site)
Severity: high — CVSS 8.2
Published: 2026-07-29
Last updated: 2026-07-30
Exploitation: Not in CISA KEV at last sync

Original advisory: https://nvd.nist.gov/vuln/detail/CVE-2026-54574

Exploitation outlook

EPSS (FIRST.org) estimates each CVE’s probability of exploitation in the next 30 days — here is the CSIRTS.com read on those numbers.

Low exploitation riskCVE-2026-545740.14% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 4% of all scored CVEs.

Referenced CVEs

CVE	CSIRTS overview	External
CVE-2026-54574	coverage & exploitation status	NVD · CVE.org

Same CVEs, other sources

How other CERTs, PSIRTs and databases cover the vulnerabilities in this advisory.

highGHSA-9xq3-3fqg-4vg7: `proot-distro install` has a Symlink Escape (Arbitrary Host File Write) via Malicious Tar…ghsa

Recent advisories for proot-distro is a

A cluster of recent advisories against the same product widens the attack surface — attackers routinely chain freshly published CVEs on one product, so review these together.

highCVE-2026-54727: proot-distro is a utility for managing proot containers. Prior to version 5.1.6, proot-distro …nvd · 2026-07-29
highGHSA-7h3g-4w2f-fj2f: proot-distro has a Container Isolation Bypass via Crafted Restore Archiveghsa · 2026-07-29
highGHSA-9xq3-3fqg-4vg7: `proot-distro install` has a Symlink Escape (Arbitrary Host File Write) via Malicious Tar…ghsa · 2026-07-29
mediumGHSA-mfr4-mq8w-vmg6: PRoot-Distro has Path Traversal in proot-distro copy — Arbitrary Read, Write, and Persist…ghsa · 2026-07-17