Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
3 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
Affected Component - Package: proot-distro - Affected command: restore - Attack surface: Host-side Termux CLI processing a user-supplied backup archive - Vulnerability type: Container Isolation Bypass / Cross-Container Read and Write --- Affected Versions | Component | Version | |---|---| | proot-distro | 5.1.5 (confirmed affected) | | Test distro | Alpine Linux | | Architecture | aarch64 | | Device | Samsung Galaxy A23 | | Package source | https://packages-cf.termux.dev/apt/termux-main stable/main aarch64 | --- Summary When restoring a crafted backup archive, proot-distro restore accepts hardlink entries whose source path references a different installed container. The restore logic resolves the hardlink source from the archive's linkname field and copies the referenced file into the container identified by the archive entry. Although path traversal protections correctly keep the source path inside the proot-distro containers directory, no validation ensures that the hardlink source…
Recommended action: Upgrade to 5.1.6 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Repository: termux/proot-distro Component: prootdistro/commands/install.py → extractplaintar(); also helpers/docker.py → applylayer() --- Affected Versions | Component | Version | |---------------|------------------------------| | proot-distro | 5.0.2 (confirmed vulnerable) | | Termux app | 0.119.0-beta.3 | | Device / ABI | Samsung Galaxy A23 / aarch64 | | Python (host) | 3.13 | --- Vulnerability Description proot-distro install extracts a plain tarball rootfs by calling extractplaintar() in prootdistro/commands/install.py. This function correctly rejects tar member names containing .. components, but applies no equivalent check on symlink targets (member.linkname). A tar archive can therefore: 1. Plant a symlink inside the rootfs whose target is an absolute host path (e.g. /data/data/com.termux/files/home). 2. Write a subsequent regular-file member whose path traverses through that symlink name. Python's open() follows the symlink, writing the file on the host filesystem at the…
Recommended action: Upgrade to 5.1.5 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
<html<head</head<body<h1Path Traversal in <codeproot-distro copy</code — Arbitrary Read, Write, and Persistent Code Execution Outside Container Rootfs</h1 <h2Repository</h2 <phttps://github.com/termux/proot-distro</p <p<strongMaintainer:</strong @sylirre</p <hr <h2Affected Component</h2 <ul <li<strongPackage:</strong proot-distro</li <li<strongAffected command:</strong <codecopy</code</li <li<strongAttack surface:</strong Host-side Termux CLI — this is not a guest distro shell issue</li <li<strongVulnerability type:</strong Path Traversal (CWE-22)</li </ul <hr <h2Affected Versions</h2 Component | Version -- | -- proot-distro | 4.38.0 (initially discovered), 5.0.2 (confirmed still affected — tested on 2026-05-19) Test distro | Ubuntu 25.10 "Questing Quokka" (ubuntu alias) Architecture | aarch64 Device | Samsung A23 Package source | https://packages-cf.termux.dev/apt/termux-main stable/main aarch64 <hr <h2Proof of Concept</h2 <pAll tests were performed using only self-owned files and…
Recommended action: Upgrade to 5.1.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.