CVE-2026-54584 Details
Description
mport is the MidnightBSD Package Manager. mport before 2.7.8 used TMPDIR while extracting package metafiles, including when running as root or in setuid/setgid contexts. An attacker able to control the environment for a privileged mport invocation could redirect temporary metadata extraction to an attacker-controlled location. PR 123 ignores unsafe TMPDIR values in privileged contexts and rejects empty TMPDIR. This issue has been patched in version 2.7.8.
A vulnerability exists in the MidnightBSD Package Manager (Mport) versions prior to 2.7.8, where the application improperly trusts environment-controlled temporary directories during the extraction of package metadata. This issue arises particularly when Mport is executed with elevated privileges or in setuid/setgid contexts. An attacker who can manipulate the environment of a privileged Mport invocation could redirect the extraction of temporary metadata to a location controlled by the attacker. The vulnerability has been addressed in Mport version 2.7.8.
Users can upgrade to Mport version 2.7.8 to address this vulnerability.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 21, 2026CISA-ADP
Assessed Sep 25, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/MidnightBSD/mport/commit/3790fa49a36cb085f48b204ef189fb82bbee621a | [email protected] | Source CodeVendor |
| https://github.com/MidnightBSD/mport/pull/123 | [email protected] | Issue TrackingVendor |
| https://github.com/MidnightBSD/mport/releases/tag/2.7.8 | [email protected] | Release NotesVendor |
| https://github.com/MidnightBSD/mport/security/advisories/GHSA-4vv3-3h8r-q6mq | [email protected] | AdvisoryRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-377 | Insecure Temporary File | [email protected] |
| CWE-73 | External Control of File Name or Path | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| MidnightBSD mport | < 2.7.8 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 25, 2026 | CVE Modified | CISA-ADP |
| Sep 21, 2026 | New CVE Received | [email protected] |