CVE-2026-54583: mport package bundle downloads allow unsafe destination filenames
mport is the MidnightBSD Package Manager. Prior to 2.7.8, libmport/fetch.c did not consistently reject empty, dot, dot-dot, or slash-containing bundle filenames before composing package download and write paths. Malicious package index data could place an unsafe value in indexEntry->bundlefile, and the missing isvalidbundlefilename() checks allowed downloaded package data to be written outside the intended cache location or to an unsafe destination name. This issue is fixed in version 2.7.8.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
libmport/mportto a version that resolves this vulnerability.Fixed in 2.7.8
Event History
Frequently Asked Questions
Which installations are affected?
Installations using mport versions prior to 2.7.8 are affected.
What does an attacker need to exploit this issue?
The attacker needs to supply malicious package index data containing an unsafe bundlefile value, such as an empty name, dot, dot-dot, or a name containing a slash.
What is the practical impact of a successful exploit?
Downloaded package data may be written outside the intended cache location or to an unsafe destination filename.
How can I remediate the issue?
Upgrade mport to version 2.7.8, which adds the missing bundle filename validation checks.