CVE-2026-54585 in mport
Summary
by MITRE • 09/17/2026
mport is the MidnightBSD Package Manager. Prior to 2.7.8, create_sample_file() in libmport/bundle_read_install_pkg.c did not constrain absolute source and destination paths from the sample-file manifest directive to mport->root. A malicious or malformed package manifest could therefore direct privileged sample-file handling to copy or write outside the configured installation root, compromising local filesystem integrity. This issue is fixed in version 2.7.8.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 09/17/2026
The MidnightBSD Package Manager, known as import, serves as a critical infrastructure component for software distribution and system maintenance on operating systems utilizing this environment. Within its architecture, the function create_sample_file located within the libmport/bundle_read_install_pkg.c module is responsible for handling sample files specified in package manifests during installation processes. Prior to version 2.7.8, this implementation contained a significant path traversal vulnerability that allowed an attacker with the ability to supply or manipulate package manifest data to bypass intended directory restrictions. The core technical flaw lies in the failure of the create_sample_file function to properly constrain absolute source and destination paths defined by the sample-file directive within the manifest against the configured installation root, denoted as mport->root. This lack of validation means that if a malicious actor crafts a package manifest containing an absolute path pointing outside the designated sandbox or installation directory, the system will proceed with file operations at those unrestricted locations without verifying containment within the expected boundary.
This vulnerability directly impacts local filesystem integrity by enabling unauthorized write and copy operations in arbitrary directories on the host system. Because package management tools typically execute with elevated privileges to install software components into protected areas of the operating system, an attacker can leverage this flaw to overwrite critical system binaries, inject malicious configuration files, or establish persistence mechanisms outside standard monitoring scopes. The operational impact is severe as it allows for privilege escalation and potential remote code execution if combined with other vectors, effectively compromising the trust model that relies on signed and verified package contents. By writing to arbitrary locations, an attacker could replace legitimate libraries or executables, leading to system instability, data exfiltration, or complete compromise of the host environment depending on which files are targeted.
From a classification perspective, this issue aligns with CWE-22 Improper Limitation of a Pathname to a Restricted Directory and CWE-73 External Control of File Name or Path in ATT&CK techniques related to persistence and privilege escalation via file manipulation. The vulnerability represents a classic path traversal scenario where input validation is insufficiently rigorous against absolute paths rather than relative ones, allowing the application logic to be subverted into accessing resources outside its intended scope. Mitigation strategies primarily involve upgrading the import package manager to version 2.7.8 or later, which includes patches that enforce strict boundary checks on all file operations initiated by manifest directives. Additionally, administrators should implement least-privilege principles where possible and validate incoming package manifests through automated scanning tools before installation to detect any attempts at path manipulation. Regular auditing of installed packages and monitoring for unexpected changes in system directories can also help identify exploitation attempts early.