CVE-2026-54574

Deferred Deferred - Pending Action

Path Traversal in proot-distro via Malicious Archive Symlinks

Publication date: 2026-07-29

Last updated on: 2026-07-29

Assigner: GitHub, Inc.

Description

proot-distro is a utility for managing proot containers. Prior to version 5.1.5, proot-distro install extracted plain tarball root filesystems through _extract_plain_tar() in proot_distro/commands/install.py and Docker layers through _apply_layer() in proot_distro/helpers/docker.py without validating archive-controlled symlink targets in member.linkname, allowing a malicious archive to plant an absolute host-path symlink and write files through it onto the host filesystem. This issue is fixed in version 5.1.5.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-29

Last Modified

2026-07-29

Generated

2026-08-19

AI Q&A

2026-07-30

EPSS Evaluated

2026-08-18

NVD

CVE-2026-54574

Affected Vendors & Products

Vendor	Product	Version / Range
proot	distro	to 5.1.5 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-61	The product, when opening a file or directory, does not sufficiently account for when the file is a symbolic link that resolves to a target outside of the intended control sphere. This could allow an attacker to cause the product to operate on unauthorized files.

Attack-Flow Graph

Executive Summary

proot-distro before version 5.1.5 has a flaw in how it extracts tarballs and Docker layers. It fails to validate symlink targets in archives, allowing malicious archives to create absolute path symlinks that write files to the host filesystem.

Detection Guidance

This vulnerability involves improper handling of symlinks in proot-distro archives. To detect it, check for proot-distro versions before 5.1.5 using commands like 'proot-distro version' or 'dpkg -l | grep proot-distro'. Inspect any custom tarballs or Docker layers used with proot-distro for absolute path symlinks in their contents.

Impact Analysis

An attacker could craft a malicious archive to overwrite critical host files, leading to system compromise, data loss, or unauthorized access. Users running vulnerable versions risk host system integrity.

Compliance Impact

This vulnerability could lead to unauthorized data access or modification, violating GDPR's integrity/confidentiality principles and HIPAA's security requirements for protected health information.

Mitigation Strategies

Update proot-distro to version 5.1.5 or later to address the symlink vulnerability in archive extraction and Docker layer handling.

Hi! I’m here to help you understand CVE-2026-54574. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70