A crafted restore archive can exploit proot-distro's legacy restore function, which accepts hardlink entries that reference another installed container without verifying that the source container matches the destination being restored. The result is that files can be copied between otherwise isolated containers, enabling an attacker to read or modify data in a container they should not have access to. The vulnerability is a classic example of CWE‑668, where resource manipulation allows information exposure.

The issue affects all releases of the Termux proot-distro utility prior to version 5.1.6. Users running any of those versions on systems where multiple proot containers are managed are potentially exposed.

The CVSS score of 8.2 classifies the flaw as high severity, while the EPSS figure of less than 1 % indicates a low current exploitation probability. It is not listed in CISA's KEV catalog. The flaw can be abused locally when an attacker can supply a crafted restore archive to the vulnerable proot‑distro restore process; no network exposure or privilege escalation is required beyond control of the restore command. Consequently, the risk is significant but largely confined to environments that use the vulnerable restore feature.