CVE-2026-54727

Name of the Vulnerable Software and Affected Versions proot-distro versions prior to 5.1.6

Description proot-distro is a utility for managing proot containers. The restore command fails to verify that the hardlink source container matches the destination container being restored. When processing a crafted backup archive, the utility resolves the hardlink source from the linkname field and copies the referenced file into the destination container. While path traversal protections prevent access outside the containers directory, the lack of container-to-container validation allows a malicious archive to copy files between otherwise isolated containers. This can lead to cross-container file disclosure, such as the exposure of SSH private keys, API credentials, and configuration secrets, as well as cross-container file injection.

Recommendations Update proot-distro to version 5.1.6 or later. As a temporary mitigation, avoid using the restore command with backup archives from untrusted sources.