Loading story…
A high-severity flaw tracked as CVE-2026-54574 affects Termux proot-distro versions earlier than 5.1.5, allowing a malicious archive to escape the intended extraction directory and write files to arbitrary locations on the host filesystem. The bug lies in proot-distro's handling of plain tarball root filesystems and Docker layers during operations such as proot-distro install and proot-distro restore, where archive-controlled symbolic links were not safely validated before subsequent files were extracted through them.
The vulnerability arises because lexical path traversal checks did not account for filesystem state changes after a symlink was created, enabling an attacker to craft an archive that first creates a symlink to an absolute host path and then writes a later file through that link. Reported impact includes possible writes to sensitive files such as /etc/shadow or files in a Termux home directory, with the issue classified as CWE-61 and scored CVSS 7.1 (AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N). The issue was fixed in proot-distro 5.1.5, including a safer extraction approach using _safe_resolve() in proot_distro/helpers/tar_extract.py.
See affected versions and whether adversaries are exploiting it.
1 event from the most recent confirmed update back to the earliest known activity.
The symlink escape and arbitrary host file write vulnerability affecting proot-distro versions earlier than 5.1.5 was fixed in release 5.1.5. The flaw involved unsafe handling of archive-controlled symlinks during tar extraction, enabling writes to host filesystem paths via malicious archives.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
2 references tracked. Mallory keeps watching after this page renders.
cvefeed.io
Open sourcecvereports.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A high-severity vulnerability tracked as **CVE-2026-54727** affected `proot-distro` versions earlier than **5.1.6**, allowing a crafted restore archive to bypass container isolation in Termux. The flaw was in the restore process for TAR hardlinks: the tool verified that links stayed within the broader containers directory, but did not ensure the hardlink source belonged to the same container being restored. As a result, a malicious archive could create links into another installed container's `rootfs` owned by the same user and copy or expose files across otherwise isolated environments. Reports also described a second weakness in `names.py`, where use of the Python regex anchor `$` instead of `\Z` allowed trailing newline characters in container names, creating potential command-injection or filesystem-confusion risks. The issue was classified as **CWE-668** with CVSS v3.1 `AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N`, and maintainers fixed it in **proot-distro 5.1.6** by rejecting hardlinks whose source container does not match the restore target and tightening container-name validation.
Jul 30, 2026
Multiple newly disclosed vulnerabilities exposed **arbitrary file write** paths through symlink handling and path validation failures in developer and server-side software. In **Crawl4AI** before `0.8.8`, `CVE-2026-56258` affects screenshot and PDF endpoints by combining weak `output_path` validation, symlink following, and a **TOCTOU** race, allowing unauthenticated remote attackers to write files outside the intended directory and potentially reach code execution. In **Cursor Desktop** before `3.0`, `CVE-2026-50549` lets a malicious agent escape the workspace sandbox by forcing path canonicalization to fail and then abusing an in-workspace symlink to write arbitrary files under the user’s privileges, including paths that could enable later unsandboxed execution. A related pattern also appeared in archive extraction and privileged upload handling. The **extract-zip** package is affected by `CVE-2026-56876`, which fails to validate symlink targets inside ZIP archives, enabling path traversal outside the extraction directory and possible arbitrary file read or write when processing untrusted archives. Separately, **pwnlift** disclosed `CVE-2026-56815` in a privileged upload handler that could be abused for arbitrary file write **as root** through direct symlink following and a TOCTOU race; an initial fix was bypassable before a follow-up patch was merged, while one downstream deployment mitigated exposure by removing the privileged `sudo` entry. Together, the disclosures highlight recurring risk from incomplete path canonicalization, unsafe symlink handling, and containment checks in file-write workflows.
Jul 2, 2026
A critical flaw tracked as **CVE-2026-47187** affects **SSHFS** versions earlier than **3.7.6**, allowing a malicious or rogue **SFTP** server to trigger local file read or write on a client system through crafted symlinks. The issue stems from SSHFS passing absolute symlink targets or relative targets containing `..` traversal components through FUSE, after which the local kernel VFS can resolve those paths outside the mounted filesystem. If a user or client-side tool such as `cp`, `rsync`, backup software, or an editor follows the link, local readable files can be exposed or attacker-controlled data can be written into writable local files, including startup or scheduled-task locations. The fix was merged into **libfuse/sshfs** as a new **`contain_symlinks`** protection that is enabled by default and rejects absolute symlink targets and any target containing `..`, returning **`EPERM`**. Maintainers described the approach as intentionally strict and lexical because an adversarial filesystem can manipulate intermediate path components, making depth-based checks unreliable. The update also adds a **`no_contain_symlinks`** opt-out for trusted legacy environments, updates documentation, and includes tests covering blocked traversal attempts, safe symlinks, option precedence, and interactions with `transform_symlinks`.
Aug 19, 2026