CyberRota Analysis
AI-GeneratedThe vulnerability affects proot-distro versions prior to 5.1.5, allowing attackers to exploit unvalidated symlink targets in extracted Docker layers and tarball root filesystems. This could enable a malicious archive to create absolute host-path symlinks, potentially leading to unauthorized file writes on the host filesystem. Organizations using proot-distro with Docker should prioritize upgrading to version 5.1.5 to mitigate this high-severity risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
proot-distro is a utility for managing proot containers. Prior to version 5.1.5, proot-distro install extracted plain tarball root filesystems through _extract_plain_tar() in proot_distro/commands/install.py and Docker layers through _apply_layer() in proot_distro/helpers/docker.py without validating archive-controlled symlink targets in member.linkname, allowing a malicious archive to plant an absolute host-path symlink and write files through it onto the host filesystem. This issue is fixed in version 5.1.5.