GHSA-MFR4-MQ8W-VMG6: Patch Does Not Address copy Path Traversal

Vulnerability

GHSA-MFR4-MQ8W-VMG6 describes a path traversal flaw in proot-distro prior to 5.1.0 where the copy command can escape container directory constraints and read or write arbitrary host files. The security impact depends on how source and destination paths are resolved across the container/host boundary: if user-controlled paths are joined without canonicalization and boundary enforcement, traversal sequences such as .. or symlink-mediated escapes can redirect file operations outside the intended root.

The supplied advisory establishes the vulnerability and affected version range, but the supplied compare view does not include a code diff for the copy implementation, path normalization helpers, or any validation logic that would prove containment enforcement. That gap is material because traversal fixes normally require explicit checks on canonical paths, symlink handling, and post-resolution prefix validation.

# Expected class of remediation for a copy traversal bug
resolved = realpath(join(container_root, user_path))
if not resolved.startswith(realpath(container_root) + "/"):
    raise SecurityError("path escapes container root")

The snippet above is illustrative of the required control, not extracted from the patch. No such fix is visible in the provided patch excerpts from the official compare reference.

Patch

The provided patch evidence from v5.0.2...v5.1.0 shows two visible changes:

• proot_distro/commands/help.py: help text changes termux/termux-docker to termux/termux-docker:aarch64.
• CLAUDE.md: extensive documentation additions for build-related modules and command behavior.

- [f"{PROGRAM_NAME} install termux/termux-docker"], width,
+ [f"{PROGRAM_NAME} install termux/termux-docker:aarch64"], width,

Neither visible change is related to path traversal prevention in a file-copy path. There is no supplied diff for the vulnerable command, no introduction of canonicalization routines, no root-boundary checks, and no tests demonstrating rejection of traversal payloads. While the advisory states that versions before 5.1.0 are affected and implies 5.1.0 contains the fix, the supplied patch summary does not expose the relevant implementation details needed for code-level validation.

Because the review must remain source-grounded, the only defensible conclusion from the supplied materials is that the visible patch evidence does not substantiate a fix for the reported container escape.

Review

Pros

• The advisory at GitHub Security Advisory clearly identifies the vulnerability class, affected component, and fixed version boundary.
• The official compare URL v5.0.2...v5.1.0 provides a canonical release-to-release reference point.
• The documentation additions in CLAUDE.md improve architectural visibility for build-related code, which can indirectly help future security review.

Cons

• The supplied diff excerpts do not show any modification to the copy command, path resolution logic, symlink handling, or filesystem boundary enforcement.
• No regression tests are provided for traversal payloads such as ../, absolute paths, symlink escapes, or mixed host/container path edge cases.
• No evidence is shown for canonicalization using realpath-style resolution followed by prefix validation against the container root.
• No evidence is shown for TOCTOU-resistant handling around path validation and file open/copy operations.
• The visible changes are operationally unrelated to the reported vulnerability, which weakens confidence that the patch summary is complete enough for security sign-off.

Verdict

Bandaid.

Based strictly on the supplied sources, the patch evidence does not demonstrate remediation of the root cause. The advisory says 5.1.0 fixes the issue, but the provided compare snippets only show help-text and documentation changes. For a traversal vulnerability that enables container escape, reviewers should require the actual copy implementation diff plus tests covering canonical path enforcement, symlink traversal, absolute-path rejection or rebasing, and destination/source validation after resolution. Until that evidence is available, this patch set cannot be validated as a root-cause fix from the materials provided.

References: official patch reference, GitHub Security Advisory, third-party report.