CVE-2026-54727 proot-distro has a Container Isolation Bypass via Crafted Restore Archive
Attackers can bypass container isolation in proot-distro by crafting restore archives with malicious hardlinks, allowing unauthorized file access between containers.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-54727?
CVE-2026-54727 is a high-severity path traversal vulnerability in termux proot-distro, published on 29 Jul 2026. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.
Official description
proot-distro is a utility for managing proot containers. Prior to version 5.1.6, proot-distro restore accepted hardlink entries whose linkname referenced another installed container and did not verify that the hardlink source container matched the destination container being restored, allowing a crafted restore archive to copy files between otherwise isolated containers. This issue is fixed in version 5.1.6.
Weakness: CWE-668
Which versions are affected by CVE-2026-54727?
3 open source packages ship an affected version, including proot-distro.
| Package | Affected | Fixed in |
|---|---|---|
proot-distro PyPI | All versions | 5.1.6 |
proot-distro PyPI | All versions | 5.1.6 |
proot-distro PyPI | All versions | 5.1.6 |
How do I fix CVE-2026-54727?
Upgrade proot-distro to 5.1.6 or later.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2026-54727 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-54727 exists.
Sources
Also known as GHSA-7h3g-4w2f-fj2f, PYSEC-2026-3607.