CVE-2026-54587: Midnightbsd Mport

Medium severity, CVSS 5.8. EPSS: 0.1% chance of exploitation in the next 30 days.

mport is the MidnightBSD Package Manager. Prior to 2.7.8, directory assets handled as ASSET_DIR or ASSET_DIR_OWNER_MODE in libmport/bundle_read_install_pkg.c used path-based mport_mkdirp(), ownership, and permission operations. A local attacker able to modify part of the target installation tree could use dot-dot traversal or substitute symlinks during privileged package installation, causing directory creation or attribute changes to affect attacker-selected paths outside the intended package directories. This issue is fixed in version 2.7.8.

Affected products

• Midnightbsd Mport: before 2.7.8 (fixed in 2.7.8)

Published 2026-09-17. Last modified 2026-09-17.