Vulnerability · Published Sep 21, 2026 · Assigned by GitHub_M

CVE-2026-54584mport trusts environment-controlled temporary directories in privileged metadata extraction

Medium 5.3

In plain English

A medium-severity security flaw in mport from MidnightBSD. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 41% of all known vulnerabilities).

Severity (CVSS 4.0)5.3Medium

Exploit odds (30 days)0.5%top 59.5% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

mport is the MidnightBSD Package Manager. mport before 2.7.8 used TMPDIR while extracting package metafiles, including when running as root or in setuid/setgid contexts. An attacker able to control the environment for a privileged mport invocation could redirect temporary metadata extraction to an attacker-controlled location. PR 123 ignores unsafe TMPDIR values in privileged contexts and rejects empty TMPDIR. This issue has been patched in version 2.7.8.

Affected products (as reported)

Vendor	Product	Versions
MidnightBSD	mport	< 2.7.8

Weakness: CWE-73, CWE-377 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

References

https://github.com/MidnightBSD/mport/security/advisories/GHSA-4vv3-3h8r-q6mq x_refsource_CONFIRM
https://github.com/MidnightBSD/mport/pull/123 x_refsource_MISC
https://github.com/MidnightBSD/mport/commit/3790fa49a36cb085f48b204ef189fb82bbee621a x_refsource_MISC
https://github.com/MidnightBSD/mport/releases/tag/2.7.8 x_refsource_MISC