Medium severity · published Sep 21, 2026
CVE-2026-54584
mport trusts environment-controlled temporary directories in privileged metadata extraction
5.3
CVSS
0.5%
EPSS
No
On KEV
Description
mport is the MidnightBSD Package Manager. mport before 2.7.8 used TMPDIR while extracting package metafiles, including when running as root or in setuid/setgid contexts. An attacker able to control the environment for a privileged mport invocation could redirect temporary metadata extraction to an attacker-controlled location. PR 123 ignores unsafe TMPDIR values in privileged contexts and rejects empty TMPDIR. This issue has been patched in version 2.7.8.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 40% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
MP
mport · MidnightBSD
< 2.7.8 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-54584
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-54584
github.com
https://github.com/MidnightBSD/mport/commit/3790fa49a36cb085f48b204ef189fb82bbee621a
github.com
https://github.com/MidnightBSD/mport/pull/123
github.com
https://github.com/MidnightBSD/mport/releases/tag/2.7.8
github.com
https://github.com/MidnightBSD/mport/security/advisories/GHSA-4vv3-3h8r-q6mq
More from mport
8.3
CVE-2026-54580
mport index decompression can leave partial or corrupt index data after zstd failures
8.3
CVE-2026-54583
mport package bundle downloads allow unsafe destination filenames
8.3
CVE-2026-54581
mport bootstrap index fetch can continue after hash verification failure
6.0
CVE-2026-54586
mport permits repository and package mirror fetches over insecure transport
6.0
CVE-2026-54585
mport sample file handling can write outside the configured root