mport permits repository and package mirror fetches over insecure transport

mport sample file handling can write outside the configured root

mport package installation can overwrite existing unmanaged or differently owned files

mport package installation has symlink TOCTOU in chown and chmod handling

mport directory asset installation is vulnerable to symlink and path traversal races

mport package fetch and clean paths are vulnerable to TOCTOU filesystem races

mport trusts environment-controlled temporary directories in privileged metadata extraction