Medium severity · published Sep 17, 2026
CVE-2026-54587
mport directory asset installation is vulnerable to symlink and path traversal races
5.8
CVSS
0.1%
EPSS
No
On KEV
Description
mport is the MidnightBSD Package Manager. Prior to 2.7.8, directory assets handled as ASSET_DIR or ASSET_DIR_OWNER_MODE in libmport/bundle_read_install_pkg.c used path-based mport_mkdirp(), ownership, and permission operations. A local attacker able to modify part of the target installation tree could use dot-dot traversal or substitute symlinks during privileged package installation, causing directory creation or attribute changes to affect attacker-selected paths outside the intended package directories. This issue is fixed in version 2.7.8.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.1% · higher than 1% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
MP
mport · MidnightBSD
< 2.7.8 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-54587
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-54587
github.com
https://github.com/MidnightBSD/mport/commit/a4fa996df1fbebeff3691e1b512c807b5f414b5d
github.com
https://github.com/MidnightBSD/mport/pull/119
github.com
https://github.com/MidnightBSD/mport/releases/tag/2.7.8
github.com
https://github.com/MidnightBSD/mport/security/advisories/GHSA-f69w-h3gh-r86p
More from mport
8.3
CVE-2026-54580
mport index decompression can leave partial or corrupt index data after zstd failures
8.3
CVE-2026-54583
mport package bundle downloads allow unsafe destination filenames
8.3
CVE-2026-54581
mport bootstrap index fetch can continue after hash verification failure
6.0
CVE-2026-54586
mport permits repository and package mirror fetches over insecure transport
6.0
CVE-2026-54585
mport sample file handling can write outside the configured root