CVE-2026-54583
HighCVSS 8.3Summary
MidnightBSD Package Manager (mport) prior to 2.7.8 did not consistently reject empty, dot, dot-dot, or slash-containing bundle filenames before composing package download and write paths. Malicious package index data could cause downloaded package data to be written outside the intended cache location or to an unsafe destination name.
Risk Assessment
An attacker controlling the package index could cause files to be written to unintended locations, potentially overwriting important files or enabling further attack escalation.
Recommendation
Update mport to version 2.7.8 or later, which includes the fix for bundle filename validation.
Other vulnerabilities in mport
See all- CVE-2026-54587Medium
mport, the MidnightBSD Package Manager, prior to 2.7.8 handled directory assets (ASSET_DIR or ASSET_DIR_OWNER_MODE) in libmport/bundle_read_install_pkg.c using path-based mport_mkdirp(), ownership, and permission operations. A local attacker able to modify part of the target installation tree could use dot-dot traversal or substitute symlinks during privileged package installation, causing directory creation or attribute changes to affect attacker-selected paths outside the intended package directories.
- CVE-2026-54586Medium
mport, the MidnightBSD Package Manager, prior to 2.7.8 accepted non-HTTPS repository and package mirror URLs without a url_is_https() enforcement check in mport_fetch_index(), mport_fetch_bootstrap_index(), and mport_fetch_bundle() in libmport/fetch.c. When a cleartext URL was configured or returned by mirror data, a network-positioned attacker could tamper with package index or package download traffic and compromise package selection or integrity.
- CVE-2026-54585Medium
mport, the MidnightBSD Package Manager, prior to 2.7.8 in create_sample_file() in libmport/bundle_read_install_pkg.c did not constrain absolute source and destination paths from the sample-file manifest directive to mport->root. A malicious or malformed package manifest could therefore direct privileged sample-file handling to copy or write outside the configured installation root, compromising local filesystem integrity.
- CVE-2026-54582Medium
mport, the MidnightBSD Package Manager, prior to 2.7.8 lacked a preflight check for incoming non-directory assets that already existed on disk. The affected logic across libmport/check_preconditions.c, libmport/install_primative.c, and libmport/mport_private.h did not apply MPORT_PRECHECK_FILE_CONFLICTS, so a crafted or conflicting package could overwrite a file owned by another package or unmanaged by mport. The check is bypassed only when the operator explicitly enables mport->force.
- CVE-2026-54581High
The mport_fetch_bootstrap_index() function in libmport/fetch.c prior to 2.7.8 could return success when bootstrap index hash verification encountered a missing or invalid hash because the failure path did not preserve a fatal result. A network attacker or compromised mirror could therefore cause mport to proceed with an unverified or tampered bootstrap package index.
- CVE-2026-54580High
In mport prior to 2.7.8, mport_decompress_zstd() in libmport/util.c did not make every truncated, corrupt, or failed zstd stream fatal, and libmport/fetch.c did not consistently propagate those failures to index-fetch callers. A malicious or faulty mirror could supply compressed package index data that caused partial index output to remain available, resulting in package-index integrity loss or denial of service.
- CVE-2026-54579Low
The MidnightBSD package manager mport in versions prior to 2.7.8 does not validate icmp_id and icmp_seq in ICMP replies and uses a fixed IP-header offset instead of ip_hl. A network attacker can influence mirror latency selection or trigger an out-of-bounds read via a malformed packet. The issue is fixed in version 2.7.8.
- CVE-2026-54578Low
The MidnightBSD package manager mport in versions prior to 2.7.8 continues after MD5File() or SHA256_File() failure and compares an expected checksum with stale data in the hash buffer instead of a newly computed digest. An attacker able to influence an installed file or hashing failure conditions can obtain a misleading integrity result or hide a checksum failure. The issue is fixed in version 2.7.8.
- CVE-2026-54577Low
The MidnightBSD package manager mport in versions prior to 2.7.8 in the audit command computes adjusted local_argv and local_argc values but passes the original argument entry to audit_package(). When an operator uses an option such as -r before a package name, stale optind state can cause auditing of the option token instead of the requested package, yielding a false-negative result. The issue is fixed in version 2.7.8.
- CVE-2026-54576Medium
mport, the MidnightBSD Package Manager, prior to 2.7.8 in do_actual_install() in libmport/bundle_read_install_pkg.c used path-based lstat(), chown(), stat(), and chmod() operations while installing package files. A local attacker with write access to a target directory could replace a checked file with a symlink before privileged ownership or mode changes were applied, redirecting those changes to an attacker-selected path and compromising filesystem integrity or permissions.
Original NVD description (English source)
mport is the MidnightBSD Package Manager. Prior to 2.7.8, libmport/fetch.c did not consistently reject empty, dot, dot-dot, or slash-containing bundle filenames before composing package download and write paths. Malicious package index data could place an unsafe value in indexEntry->bundlefile, and the missing is_valid_bundle_filename() checks allowed downloaded package data to be written outside the intended cache location or to an unsafe destination name. This issue is fixed in version 2.7.8.