CVE-2026-54584

What it is

mport is the MidnightBSD Package Manager. mport before 2.7.8 used TMPDIR while extracting package metafiles, including when running as root or in setuid/setgid contexts. An attacker able to control the environment for a privileged mport invocation could redirect temporary metadata extraction to an attacker-controlled location. PR 123 ignores unsafe TMPDIR values in privileged contexts and rejects empty TMPDIR. This issue has been patched in version 2.7.8.

At a glance

Exploitability

Can be exploited over the network with a low-privilege account. Limited direct impact.

Exploit odds

0.5% chance of exploitation in the next 30 days (EPSS).

Fix

A patch, advisory or fixed version is referenced. Upgrade or apply it.

Timeline

1. 2026-09-21 15:17 UTC PublishedDisclosed publicly on CVE.org and NVD
2. 2026-09-25 20:17 UTC Last updatedMost recent change to the record

Details

Published

2026-09-21 15:17 UTC

Last modified

2026-09-25 20:17 UTC

Exploit probability

0.5% · EPSS, next 30 days

Weakness

CWE-73

Record status

Deferred

Attack profile CVSS 4.0 · 5.3

Attack vector

Network

Complexity

Low

Attack requirements

None

Privileges needed

Low

User interaction

None

Confidentiality

Low

Integrity

None

Availability

None