The flaw in proot-distro allows an attacker to supply a malicious tar archive that, when extracted or applied as a Docker layer, creates a symlink with an absolute host path. Because the software does not validate the symlink target, the extracted content can be written outside the intended container root, overwriting or creating arbitrary files on the host file system. This leads to loss of confidentiality, integrity, and potential remote execution if system configuration files or executables are altered. The weakness is classified as CWE‑61, a classic path traversal via symlink.

Termux Proot‑distro utility, version 5.1.4 and earlier. The vulnerability was fixed in release 5.1.5.

The CVSS score of 8.2 indicates high severity. The EPSS score of less than 1% suggests exploitation is unlikely but still possible, especially in environments where users install untrusted tar archives with proot‑distro. The vulnerability is not listed in the CISA KEV catalog. The attack vector is local; an attacker must run the vulnerable exector (e.g., proot‑distro install) on the target machine. No network or remote exploitation is described by the available data.