CVE-2026-54587: mport directory asset installation is vulnerable to symlink and path traversal races
mport is the MidnightBSD Package Manager. Prior to 2.7.8, directory assets handled as ASSETDIR or ASSETDIROWNERMODE in libmport/bundlereadinstallpkg.c used path-based mportmkdirp(), ownership, and permission operations. A local attacker able to modify part of the target installation tree could use dot-dot traversal or substitute symlinks during privileged package installation, causing directory creation or attribute changes to affect attacker-selected paths outside the intended package directories. This issue is fixed in version 2.7.8.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
MidnightBSD Package Manager (mport)to a version that resolves this vulnerability.Fixed in 2.7.8
Event History
Frequently Asked Questions
Who is exposed to this issue?
Systems running mport versions prior to 2.7.8 are exposed when a privileged package installation processes directory assets and an untrusted local user can modify part of the target installation tree.
What does an attacker need to exploit it?
The attacker needs local ability to modify a portion of the package's target installation tree during a privileged package installation. They can use dot-dot path traversal or race the installation by substituting symlinks.
What could successful exploitation do?
It can cause directory creation, ownership changes, or permission changes to be applied to attacker-selected paths outside the intended package directories.
What should be done if upgrading is not immediately possible?
Prevent untrusted local users from modifying any part of target installation trees while privileged package installations are performed. Restrict privileged package installation until mport can be updated to 2.7.8.