medium5.3
CVE-2026-54584
mport is the MidnightBSD Package Manager.
Impact
mport is the MidnightBSD Package Manager. mport before 2.7.8 used TMPDIR while extracting package metafiles, including when running as root or in setuid/setgid contexts. An attacker able to control the environment for a privileged mport invocation could redirect temporary metadata extraction to an attacker-controlled location. PR 123 ignores unsafe TMPDIR values in privileged contexts and rejects empty TMPDIR. This issue has been patched in version 2.7.8.
Affected products
| Product | Affected versions |
|---|---|
| Mport Is The MidnightBSD Package Manager. Mport | before 2.7.8 |
Versions were read from the advisory text. No structured product data has been published for this record yet.