proot-distro is a utility for managing proot containers. Prior to version 5.1.5, proot-distro install extracted plain tarball root filesystems through _extract_…

CVE-2026-54574 affects proot-distro, a utility for managing proot containers, in versions prior to 5.1.5. The vulnerability exists in two functions: _extract_plain_tar() in install.py and _apply_layer() in docker.py, both of which fail to validate archive-controlled symlink targets in member.linkname fields. A malicious archive can exploit this by planting an absolute host-path symlink, allowing arbitrary file writes to the host filesystem outside the container boundary. This constitutes a container escape/path traversal vulnerability that could lead to host system compromise. The attack vector requires a user to install a malicious proot-distro package or Docker layer. The issue has been patched in version 5.1.5, released by the Termux project. Users are advised to upgrade immediately to mitigate the risk of host filesystem tampering.