CVE-2026-54584

mport trusts environment-controlled temporary directories in privileged metadata extraction

State: Published
Severity: 5.3 Medium
Published: Sep 21, 2026
Updated: Sep 25, 2026
Reserved: Jun 15, 2026

Description

mport is the MidnightBSD Package Manager. mport before 2.7.8 used TMPDIR while extracting package metafiles, including when running as root or in setuid/setgid contexts. An attacker able to control the environment for a privileged mport invocation could redirect temporary metadata extraction to an attacker-controlled location. PR 123 ignores unsafe TMPDIR values in privileged contexts and rejects empty TMPDIR. This issue has been patched in version 2.7.8.

Scores

CVSS	Score	Vector	Source
4.0	5.3 Medium	CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N	GitHub_M

Weaknesses

CWE-73 External Control of File Name or Path
CWE-377 Insecure Temporary File

Affected Products

Product	Versions
mportMidnightBSD	< 2.7.8Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.