CVE-2026-54582: mport package installation can overwrite existing unmanaged or differently owned files
mport is the MidnightBSD Package Manager. Prior to 2.7.8, package installation lacked a preflight check for incoming non-directory assets that already existed on disk. The affected logic across libmport/checkpreconditions.c, libmport/installprimative.c, and libmport/mportprivate.h did not apply MPORTPRECHECKFILECONFLICTS, so a crafted or conflicting package could overwrite a file owned by another package or unmanaged by mport. The check is bypassed only when the operator explicitly enables mport->force. Privileged installation without that override could compromise local filesystem integrity and package database consistency. This issue is fixed in version 2.7.8.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
MidnightBSD Package Manager (mport)to a version that resolves this vulnerability.Fixed in 2.7.8 - Configuration
Ensure mport->force is not enabled so the preflight check for conflicting existing non-directory assets is applied (the check is bypassed only when the operator explicitly enables mport->force).
mport mport->force = disabled
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker needs a crafted or conflicting package to be installed by a privileged operator. Successful exploitation can overwrite an existing non-directory file that is unmanaged by mport or owned by a different package.
Are normal installations affected, or only forced installs?
Normal privileged installations are affected prior to version 2.7.8 because the required file-conflict preflight check was not applied. The conflict check is bypassed only when the operator explicitly enables mport->force.
What is the impact of a successful overwrite?
It can compromise local filesystem integrity and leave the package database inconsistent with files on disk. Files belonging to another package or not tracked by mport can be overwritten.
What should operators do if they cannot immediately upgrade?
Avoid installing packages that conflict with existing files, particularly files owned by other packages or unmanaged by mport, and do not use the force override. Upgrade mport to version 2.7.8 when possible.