CVE-2026-54582 in mport
Summary
by MITRE • 09/17/2026
mport is the MidnightBSD Package Manager. Prior to 2.7.8, package installation lacked a preflight check for incoming non-directory assets that already existed on disk. The affected logic across libmport/check_preconditions.c, libmport/install_primative.c, and libmport/mport_private.h did not apply MPORT_PRECHECK_FILE_CONFLICTS, so a crafted or conflicting package could overwrite a file owned by another package or unmanaged by mport. The check is bypassed only when the operator explicitly enables mport->force. Privileged installation without that override could compromise local filesystem integrity and package database consistency. This issue is fixed in version 2.7.8.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 09/17/2026
The MidnightBSD Package Manager, known as import, serves as a critical utility for managing software packages on the operating system. In versions prior to 2.7.8, a significant logic flaw existed within the package installation process that compromised the integrity of the local filesystem and the consistency of the package database. This vulnerability stems from an omission in the preflight checks performed before files are written to disk during the installation or upgrade of packages. Specifically, the functions located in libmport/check_preconditions.c, libmport/install_primative.c, and the definitions in libmport/mport_private.h failed to enforce the MPORT_PRECHECK_FILE_CONFLICTS flag for incoming non-directory assets that already existed on the target system. This oversight meant that the package manager did not verify whether a file being installed was already present and potentially managed by another package or left unmanaged by import entirely.
The technical root of this issue lies in the conditional logic governing pre-installation checks. When a package is processed, the software should validate all incoming files against existing system state to prevent overwrites that could disrupt other applications or leave orphaned configuration files. However, due to the missing enforcement of file conflict detection, any crafted or conflicting package could silently overwrite an existing file without raising an error or warning. This behavior bypasses standard safety mechanisms designed to maintain a clean and predictable software environment. The vulnerability is strictly limited in scope because it only triggers when the operator does not explicitly enable the mport->force flag; if force mode is active, overwrites are permitted by design, but this requirement for explicit override highlights that normal operations were expected to be safe from such collisions.
The operational impact of this flaw is substantial for system administrators and users relying on import for package management. A malicious actor or a poorly constructed third-party package could exploit this condition to overwrite critical binaries, libraries, or configuration files owned by other packages. This can lead to the degradation of system stability, as overwritten components may no longer function correctly with their dependencies. Furthermore, it compromises local filesystem integrity because the package database will record that a file belongs to the newly installed package, even though it was originally part of another software component. This inconsistency makes troubleshooting difficult and can create security gaps if sensitive files are replaced with malicious counterparts. The lack of conflict detection also risks leaving behind orphaned files from previously uninstalled packages or creating duplicate entries in the database, which undermines the reliability of dependency resolution for future installations.
This vulnerability aligns with CWE-613, Insufficient Session Expiration, and more accurately CWE-278, Incorrect Presumption of Security, as it assumes that file paths are unique to a single package without verifying actual ownership or existence constraints. In terms of the MITRE ATT&CK framework, this flaw facilitates techniques related to Defense Evasion by allowing an attacker to overwrite legitimate system files with malicious ones while maintaining plausible deniability through consistent database entries. It also touches upon Persistence mechanisms if critical executables are replaced to ensure continued access after reboots or updates. To mitigate these risks, it is imperative that organizations upgrade import to version 2.7.8 immediately, as this release corrects the preflight logic to properly enforce file conflict checks for all non-directory assets during standard installation procedures. Administrators should also audit their package databases for any signs of inconsistency resulting from prior installations using vulnerable versions and consider implementing additional integrity monitoring tools such as AIDE or Tripwire to detect unauthorized changes to critical system files.