Home › CVE Intelligence › CVE-2026-54574
CVSS 8.2 HIGH Vulnerability

CVE-2026-54574: `proot-distro install` has a Symlink Escape (Arbitrary Host File Write) via Malicious Tar…

Repository: termux/proot-distro Component: proot_distro/commands/install.py → _extract_plain_tar(); also helpers/docker.py → _apply_layer() --Affected Versions | Component | Version | |---------------|------------------…

8.2CVSS Score
HIGHSeverity
NOCISA KEV
VulnerabilityImpact Type

📋 Vulnerability Details

CVE IDCVE-2026-54574
Vendorpip
Affected Productproot-distro
Vulnerability TypeVulnerability
CVSS Score8.2 (HIGH)
Actively Exploited❌ No known exploitation
Patch StatusSee Vendor Advisory →
Reported ByCYBERDUDEBIVASH SENTINEL APEX Intelligence (via github_advisories)

🔬 Technical Analysis

Repository: termux/proot-distro Component: proot_distro/commands/install.py → _extract_plain_tar(); also helpers/docker.py → _apply_layer() ---

## Affected VersionsComponentVersion
proot-distro5.0.2 (confirmed vulnerable)
Termux app0.119.0-beta.3
Device / ABISamsung Galaxy A23 / aarch64
Python (host)3.13---

Vulnerability Description proot-distro install extracts a plain tarball rootfs by calling _extract_plain_tar() in

proot_distro/commands/install.py. This function correctly rejects tar member names containing .. components, but applies no equivalent check on symlink targets (member.linkname). A tar archive can therefore: 1. Plant a symlink inside the rootfs whose t

📚 Advisory References

⚡ DETECTION RULES AVAILABLE

Get CVE-2026-54574 Detection Pack

Sigma rules, YARA signatures, IOC table, and SIEM queries for Splunk, Elastic, Sentinel, and Chronicle — deployable in 5 minutes.

✓ Sigma Rules ✓ YARA Pack ✓ IOC Table ✓ SIEM Queries
🛡️ Get Detection Pack → 🔌 Access via API →

🔗 Related Intelligence