CVE-2026-54584: mport trusts environment-controlled temporary directories in privileged metadata extraction
mport is the MidnightBSD Package Manager. mport before 2.7.8 used TMPDIR while extracting package metafiles, including when running as root or in setuid/setgid contexts. An attacker able to control the environment for a privileged mport invocation could redirect temporary metadata extraction to an attacker-controlled location. PR 123 ignores unsafe TMPDIR values in privileged contexts and rejects empty TMPDIR. This issue has been patched in version 2.7.8.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
MidnightBSD mportto a version that resolves this vulnerability.Fixed in 2.7.8Patch PR 123
Event History
Frequently Asked Questions
Who is exposed to this issue?
Systems running mport before 2.7.8 are exposed when mport is invoked with root, setuid, or setgid privileges and an attacker can control that invocation's environment.
What does an attacker need to exploit it?
The attacker needs the ability to set TMPDIR for a privileged mport process. They can then direct package metadata extraction to an attacker-controlled temporary location.
Are normal unprivileged mport invocations affected in the same way?
The described risk is specifically tied to privileged mport invocations, including root and setuid/setgid contexts. The provided information does not identify the same privilege boundary impact for unprivileged use.
What should be done if upgrading cannot happen immediately?
Do not allow untrusted users or processes to control TMPDIR or the environment of privileged mport invocations. Use a trusted, non-empty temporary-directory setting for those executions.
How can I determine whether a system is remediated?
Verify that mport is version 2.7.8 or later. The fix ignores unsafe TMPDIR values in privileged contexts and rejects an empty TMPDIR value.