https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 03 Oct 2026 03:27:58 +0000 https://cve.radiocsirt.org/vuln/cve-2026-54727 <p><strong>Affected:</strong> termux proot-distro</p> <p>proot-distro is a utility for managing proot containers. Prior to version 5.1.6, proot-distro restore accepted hardlink entries whose linkname referenced another installed container and did not verify that the hardlink source container matched the destination container being restored, allowing a crafted restore archive to copy files between otherwise isolated containers. This issue is fixed in version 5.1.6.</p> <p><strong>Affected:</strong> termux proot-distro</p> <p>proot-distro is a utility for managing proot containers. Prior to version 5.1.6, proot-distro restore accepted hardlink entries whose linkname referenced another installed container and did not verify that the hardlink source container matched the destination container being restored, allowing a crafted restore archive to copy files between otherwise isolated containers. This issue is fixed in version 5.1.6.</p> https://cve.radiocsirt.org/vuln/cve-2026-54727 https://cve.radiocsirt.org/vuln/ghsa-7h3g-4w2f-fj2f <p><strong>Affected:</strong> PyPI: proot-distro</p> <p>## Affected Component</p> <p>- **Package:** proot-distro - **Affected command:** `restore` - **Attack surface:** Host-side Termux CLI processing a user-supplied backup archive - **Vulnerability type:** Container Isolation Bypass / Cross-Container Read and Write</p> <p>---</p> <p>## Affected Versions</p> <p>| Component | Version | |---|---| | proot-distro | 5.1.5 (confirmed affected) | | Test distro | Alpine Linux | | Architecture | aarch64 | | Device | Samsung Galaxy A23 | | Package source | https://packages-cf.termux.dev/apt/termux-main stable/main aarch64 |</p> <p>---</p> <p>## Summary</p> <p>When restoring a crafted backup archive, `proot-distro restore` accepts hardlink entries whose source path references a different installed container.</p> <p>The restore logic resolves the hardlink source from the archive&#39;s `linkname` field and copies the referenced file into the container identified by the archive entry.</p> <p>Although path traversal protections correctly keep the source path inside the proot-distro containers directory, no validation ensures that the hardlink source container matches the destination container.</p> <p>As a result, a malicious backup archive can copy files between otherwise isolated containers, enabling both cross-container disclosure and cross-container file injection.</p> <p>---</p> <p>## Proof of Concept #1 — Cross-Container File Disclosure</p> <p>All testing was performed using self-owned containers and harmless marker data only.</p> <p>### Step 1 — Create a victim container and marker file</p> <p>```bash proot-distro install alpine -…</p> <p><strong>Affected:</strong> PyPI: proot-distro</p> <p>## Affected Component</p> <p>- **Package:** proot-distro - **Affected command:** `restore` - **Attack surface:** Host-side Termux CLI processing a user-supplied backup archive - **Vulnerability type:** Container Isolation Bypass / Cross-Container Read and Write</p> <p>---</p> <p>## Affected Versions</p> <p>| Component | Version | |---|---| | proot-distro | 5.1.5 (confirmed affected) | | Test distro | Alpine Linux | | Architecture | aarch64 | | Device | Samsung Galaxy A23 | | Package source | https://packages-cf.termux.dev/apt/termux-main stable/main aarch64 |</p> <p>---</p> <p>## Summary</p> <p>When restoring a crafted backup archive, `proot-distro restore` accepts hardlink entries whose source path references a different installed container.</p> <p>The restore logic resolves the hardlink source from the archive&#39;s `linkname` field and copies the referenced file into the container identified by the archive entry.</p> <p>Although path traversal protections correctly keep the source path inside the proot-distro containers directory, no validation ensures that the hardlink source container matches the destination container.</p> <p>As a result, a malicious backup archive can copy files between otherwise isolated containers, enabling both cross-container disclosure and cross-container file injection.</p> <p>---</p> <p>## Proof of Concept #1 — Cross-Container File Disclosure</p> <p>All testing was performed using self-owned containers and harmless marker data only.</p> <p>### Step 1 — Create a victim container and marker file</p> <p>```bash proot-distro install alpine -…</p> https://cve.radiocsirt.org/vuln/ghsa-7h3g-4w2f-fj2f