CVE-2026-54587 in mport
Summary
by MITRE • 09/17/2026
mport is the MidnightBSD Package Manager. Prior to 2.7.8, directory assets handled as ASSET_DIR or ASSET_DIR_OWNER_MODE in libmport/bundle_read_install_pkg.c used path-based mport_mkdirp(), ownership, and permission operations. A local attacker able to modify part of the target installation tree could use dot-dot traversal or substitute symlinks during privileged package installation, causing directory creation or attribute changes to affect attacker-selected paths outside the intended package directories. This issue is fixed in version 2.7.8.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 09/17/2026
The MidnightBSD Package Manager, known as mport, serves as a critical infrastructure component for software distribution and system maintenance within the Midnight BSD operating environment. In versions prior to 2.7.8, the package management utility contained a significant security flaw related to how it handled directory assets during the installation process. Specifically, when processing ASSET_DIR or ASSET_DIR_OWNER_MODE attributes defined in package manifests, the underlying implementation relied on path-based operations within the libmport/bundle_read_install_pkg.c module. This architectural choice introduced a vulnerability that allowed for improper validation of file paths before performing filesystem modifications such as directory creation and permission setting.
The core technical flaw stems from insufficient sanitization of user-supplied or manifest-defined paths, which enabled an attacker to exploit path traversal techniques. By utilizing dot-dot sequences (../) or substituting symlinks pointing to arbitrary locations on the filesystem, a local attacker could manipulate the target installation tree during privileged package installations. When mport executed with elevated privileges to install packages, it would follow these maliciously crafted paths and apply directory creation or attribute changes outside of the intended sandboxed package directories. This behavior effectively bypasses the expected isolation boundaries, allowing operations that affect system-critical areas or other user data not associated with the specific package being installed.
From an operational impact perspective, this vulnerability represents a serious risk to system integrity and confidentiality. A local attacker who has the ability to modify part of the target installation tree can escalate privileges by forcing the privileged mport process to alter permissions on sensitive directories or create malicious directory structures in unintended locations. This could lead to unauthorized access control changes, potential privilege escalation if combined with other vulnerabilities, or denial of service through disruption of system services that rely on specific directory states. The ability to affect paths outside the intended package scope means that a single compromised or maliciously crafted package manifest can have systemic consequences beyond its immediate installation context.
This vulnerability aligns with CWE-22: Improper Limitation of a Pathname to a Restricted Directory, commonly referred to as path traversal. It also relates to CWE-732: Incorrect Permission Assignment for Critical Resource, as the flaw allows unauthorized modification of file and directory permissions. In terms of offensive security frameworks, this behavior is consistent with ATT&CK technique T1059, Command and Scripting Interpreter, specifically when used in conjunction with privilege escalation tactics where an attacker leverages misconfigured system utilities to gain higher-level access or persist within the environment by altering critical filesystem attributes.
Mitigation for this issue requires immediate upgrading of the mport package manager to version 2.7.8 or later, which addresses these path validation deficiencies. System administrators should also enforce strict least-privilege principles when managing packages and ensure that only trusted sources are used for package manifests. Additionally, implementing file integrity monitoring on critical system directories can help detect unauthorized changes resulting from such exploitation attempts before they lead to broader compromise. Regular auditing of package installation logs and validating manifest contents against known-good baselines further reduces the risk surface associated with this class of vulnerabilities.