The proot-distro utility for managing proot containers had a vulnerability (CVE-2026-54727) where the restore function accepted hardlink entries referencing other installed containers without verifying that the hardlink source matched the destination container. This flaw allowed crafted restore archives to copy files between containers that should be isolated, violating container boundaries. The vulnerability is classified as CWE-668 (Exposure of Resource to Wrong Sphere). It affects versions prior to 5.1.6 and is fixed in 5.1.6. The CVSS 3.1 score is 8.2 (high severity) with vector AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N, indicating local attack vector, low complexity, no privileges required, user interaction required, scope changed, and high confidentiality and integrity impact without availability impact.

Successful exploitation allows an attacker to bypass container isolation by copying files between otherwise isolated containers, leading to a complete compromise of confidentiality and integrity of containerized data. This breaks the security model of container separation, potentially exposing sensitive information or allowing unauthorized modification of container contents.

A fix is available in proot-distro version 5.1.6. Users should upgrade to version 5.1.6 or later to remediate this vulnerability. No other mitigation or temporary workaround is indicated.