CVE-2026-54576

mport, the MidnightBSD Package Manager, prior to 2.7.8 handled directory assets (ASSET_DIR or ASSET_DIR_OWNER_MODE) in libmport/bundle_read_install_pkg.c using path-based mport_mkdirp(), ownership, and permission operations. A local attacker able to modify part of the target installation tree could use dot-dot traversal or substitute symlinks during privileged package installation, causing directory creation or attribute changes to affect attacker-selected paths outside the intended package directories.

mport, the MidnightBSD Package Manager, prior to 2.7.8 accepted non-HTTPS repository and package mirror URLs without a url_is_https() enforcement check in mport_fetch_index(), mport_fetch_bootstrap_index(), and mport_fetch_bundle() in libmport/fetch.c. When a cleartext URL was configured or returned by mirror data, a network-positioned attacker could tamper with package index or package download traffic and compromise package selection or integrity.

mport, the MidnightBSD Package Manager, prior to 2.7.8 in create_sample_file() in libmport/bundle_read_install_pkg.c did not constrain absolute source and destination paths from the sample-file manifest directive to mport->root. A malicious or malformed package manifest could therefore direct privileged sample-file handling to copy or write outside the configured installation root, compromising local filesystem integrity.

MidnightBSD Package Manager (mport) prior to 2.7.8 did not consistently reject empty, dot, dot-dot, or slash-containing bundle filenames before composing package download and write paths. Malicious package index data could cause downloaded package data to be written outside the intended cache location or to an unsafe destination name.

mport, the MidnightBSD Package Manager, prior to 2.7.8 lacked a preflight check for incoming non-directory assets that already existed on disk. The affected logic across libmport/check_preconditions.c, libmport/install_primative.c, and libmport/mport_private.h did not apply MPORT_PRECHECK_FILE_CONFLICTS, so a crafted or conflicting package could overwrite a file owned by another package or unmanaged by mport. The check is bypassed only when the operator explicitly enables mport->force.

The mport_fetch_bootstrap_index() function in libmport/fetch.c prior to 2.7.8 could return success when bootstrap index hash verification encountered a missing or invalid hash because the failure path did not preserve a fatal result. A network attacker or compromised mirror could therefore cause mport to proceed with an unverified or tampered bootstrap package index.

In mport prior to 2.7.8, mport_decompress_zstd() in libmport/util.c did not make every truncated, corrupt, or failed zstd stream fatal, and libmport/fetch.c did not consistently propagate those failures to index-fetch callers. A malicious or faulty mirror could supply compressed package index data that caused partial index output to remain available, resulting in package-index integrity loss or denial of service.

The MidnightBSD package manager mport in versions prior to 2.7.8 does not validate icmp_id and icmp_seq in ICMP replies and uses a fixed IP-header offset instead of ip_hl. A network attacker can influence mirror latency selection or trigger an out-of-bounds read via a malformed packet. The issue is fixed in version 2.7.8.

The MidnightBSD package manager mport in versions prior to 2.7.8 continues after MD5File() or SHA256_File() failure and compares an expected checksum with stale data in the hash buffer instead of a newly computed digest. An attacker able to influence an installed file or hashing failure conditions can obtain a misleading integrity result or hide a checksum failure. The issue is fixed in version 2.7.8.

The MidnightBSD package manager mport in versions prior to 2.7.8 in the audit command computes adjusted local_argv and local_argc values but passes the original argument entry to audit_package(). When an operator uses an option such as -r before a package name, stale optind state can cause auditing of the option token instead of the requested package, yielding a false-negative result. The issue is fixed in version 2.7.8.