CVE-2026-54585: mport sample file handling can write outside the configured root
mport is the MidnightBSD Package Manager. Prior to 2.7.8, createsamplefile() in libmport/bundlereadinstallpkg.c did not constrain absolute source and destination paths from the sample-file manifest directive to mport->root. A malicious or malformed package manifest could therefore direct privileged sample-file handling to copy or write outside the configured installation root, compromising local filesystem integrity. This issue is fixed in version 2.7.8.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
MidnightBSD Package Manager (mport)to a version that resolves this vulnerability.Fixed in 2.7.8
Event History
Frequently Asked Questions
Which installations are affected?
mport versions prior to 2.7.8 are affected. The issue applies when processing a package manifest that uses the sample-file directive with absolute source or destination paths.
What does an attacker need to exploit this issue?
An attacker needs to supply or cause processing of a malicious package manifest. The manifest must contain sample-file paths that direct privileged handling outside the configured installation root.
What is the impact of successful exploitation?
Privileged sample-file handling can copy or write files outside mport's configured root. This can compromise local filesystem integrity.
What should be done if patching is not immediately possible?
Avoid processing untrusted or malformed packages and manifests, particularly those containing sample-file directives with absolute paths. Restrict package sources to trusted repositories until mport can be updated.
How can I determine whether a package may be malicious?
Inspect its manifest for sample-file directives using absolute source or destination paths. On affected versions, those paths were not constrained to mport's configured root.