CVE-2026-54585 Details
Description
mport is the MidnightBSD Package Manager. Prior to 2.7.8, create_sample_file() in libmport/bundle_read_install_pkg.c did not constrain absolute source and destination paths from the sample-file manifest directive to mport->root. A malicious or malformed package manifest could therefore direct privileged sample-file handling to copy or write outside the configured installation root, compromising local filesystem integrity. This issue is fixed in version 2.7.8.
A path traversal vulnerability has been identified in the MidnightBSD Package Manager (Mport) versions prior to 2.7.8. The issue arises in the 'create_sample_file()' function within 'libmport/bundle_read_install_pkg.c', where absolute source and destination paths from the sample-file manifest directive were not properly constrained to the Mport root. This lack of validation allowed a malicious or malformed package manifest to direct privileged sample-file handling to copy or write files outside the designated installation root, potentially compromising local filesystem integrity.
Users can upgrade to Mport version 2.7.8 or later to address this vulnerability.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 17, 2026CISA-ADP
Assessed Sep 17, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/MidnightBSD/mport/commit/36a42c8ddbd23ee9eb72c4c17596eb92cb423cf0 | [email protected] | Source CodeVendor |
| https://github.com/MidnightBSD/mport/pull/122 | [email protected] | Issue TrackingVendor |
| https://github.com/MidnightBSD/mport/releases/tag/2.7.8 | [email protected] | Release NotesVendor |
| https://github.com/MidnightBSD/mport/security/advisories/GHSA-xqjc-rxmm-p27v | [email protected] | AdvisoryRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-22 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| MidnightBSD mport | < 2.7.8 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 17, 2026 | CVE Modified | CISA-ADP |
| Sep 17, 2026 | New CVE Received | [email protected] |