CVE-2026-54576: mport package installation has symlink TOCTOU in chown and chmod handling
mport is the MidnightBSD Package Manager. Prior to 2.7.8, doactualinstall() in libmport/bundlereadinstallpkg.c used path-based lstat(), chown(), stat(), and chmod() operations while installing package files. A local attacker with write access to a target directory could replace a checked file with a symlink before privileged ownership or mode changes were applied, redirecting those changes to an attacker-selected path and compromising filesystem integrity or permissions. This issue is fixed in version 2.7.8.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
mportto a version that resolves this vulnerability.Fixed in 2.7.8
Event History
Frequently Asked Questions
Who can exploit this issue?
A local attacker must have write access to a directory targeted during package installation. They can race the installer by replacing a checked file with a symlink before privileged ownership or permission changes occur.
Which installations are affected?
mport versions prior to 2.7.8 are affected. The issue is fixed in version 2.7.8.
What is the impact of successful exploitation?
An attacker can redirect privileged chown or chmod operations to an attacker-selected path. This can compromise filesystem integrity or permissions.