Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
7.3

MidnightBSD mport may write data to attacker‑chosen location

CVE-2026-54584 · published 1 month ago
Summary

The MidnightBSD package manager (mport) trusted the TMPDIR setting even when running with high privileges, so a malicious user who can set that environment variable could cause temporary files to be placed in an attacker‑controlled directory. This could lead to tampering with package metadata or other unwanted actions. Upgrade to version 2.7.8 or later, which rejects unsafe or empty TMPDIR values in privileged runs.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
midnightbsd mport < 2.7.8
Original advisory text
mport trusts environment-controlled temporary directories in privileged metadata extraction
mport is the MidnightBSD Package Manager. mport before 2.7.8 used TMPDIR while extracting package metafiles, including when running as root or in setuid/setgid contexts. An attacker able to control the environment for a privileged mport invocation could redirect temporary metadata extraction to an attacker-controlled location. PR 123 ignores unsafe TMPDIR values in privileged contexts and rejects empty TMPDIR. This issue has been patched in version 2.7.8.
References
Severity
7.3 High
Exploitation
<1% chance of attack within 30 days
Type
CWE-73External Control of File Name or Path
CWE-377Insecure Temporary File
Timeline
Published21 Sep 2026
Updated30 Oct 2026
First seen21 Sep 2026
Sources
CVE-2026-54584 · NVD
CVE-2026-54584 · MITRE
CVE-2026-54584 · OSV
GHSA-4vv3-3h8r-q6mq · GHSA
Track software like this
Free during beta