CVE-2026-54584
Received Received - Intake

Privileged Context Temporary File Traversal in mport

Publication date: 2026-09-21

Last updated on: 2026-09-21

Assigner: GitHub, Inc.

Description
mport is the MidnightBSD Package Manager. mport before 2.7.8 used TMPDIR while extracting package metafiles, including when running as root or in setuid/setgid contexts. An attacker able to control the environment for a privileged mport invocation could redirect temporary metadata extraction to an attacker-controlled location. PR 123 ignores unsafe TMPDIR values in privileged contexts and rejects empty TMPDIR. This issue has been patched in version 2.7.8.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-21
Last Modified
2026-09-21
Generated
2026-09-21
AI Q&A
2026-09-21
EPSS Evaluated
N/A
NVD
CVE-2026-54584
EUVD
EUVD-2026-83920

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
midnightbsd mport to 2.7.8 (exc)
midnightbsd mport 2.7.8

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-377 Creating and using insecure temporary files can leave application and system data vulnerable to attack.
CWE-73 The product allows user input to control or influence paths or file names that are used in filesystem operations.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability involves the MidnightBSD mport package manager before version 2.7.8. It used the TMPDIR environment variable when extracting package metafiles, even during privileged operations like running as root or setuid/setgid. An attacker controlling the environment could manipulate TMPDIR to redirect temporary metadata extraction to a malicious location.

Detection Guidance

Check the installed version of mport on your MidnightBSD system. If it is below 2.7.8, the system is vulnerable. Run: pkg info mport or mport version to verify the installed version.

Impact Analysis

An attacker could exploit this to inject malicious metadata or files into a privileged process. This could lead to arbitrary code execution, privilege escalation, or system compromise if the attacker gains control over the temporary directory used by mport during package operations.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR or HIPAA as it involves a local privilege escalation risk in the MidnightBSD mport package manager. However, if exploited, it could allow attackers to manipulate package metadata extraction, potentially leading to unauthorized software installation or system compromise. Such compromises might indirectly violate compliance requirements by exposing sensitive data or violating integrity controls.

Mitigation Strategies

Upgrade mport to version 2.7.8 or later immediately. Use: pkg update && pkg upgrade mport or mport selfupdate to apply the patch.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-54584. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart