The termux proot-distro utility, used for managing proot containers, contains a symbolic link following vulnerability (CWE-61) in versions before 5.1.5. Specifically, the functions _extract_plain_tar() and _apply_layer() do not validate symlink targets in archive members, permitting malicious archives to plant absolute symlinks that reference host paths. This flaw allows an attacker to write arbitrary files onto the host filesystem by exploiting these symlinks. The vulnerability has a CVSS 3.1 base score of 8.2, indicating high severity. The issue is resolved in proot-distro version 5.1.5.

Successful exploitation allows an attacker with local access and user interaction to write arbitrary files onto the host filesystem via maliciously crafted symlinks in extracted archives. This can lead to complete compromise of confidentiality and integrity of the host system's data. Availability impact is not indicated. The vulnerability requires local access and user interaction but has low attack complexity and no privileges required.

Upgrade proot-distro to version 5.1.5 or later, where the vulnerability is fixed. No other official remediation or temporary fixes are documented. Until upgrading, avoid extracting untrusted tarball root filesystems or Docker layers using vulnerable versions of proot-distro.