Public mode

No access to your tenant or devices. Every item links to its source. What this means

CVE-2026-54587

mport directory asset installation is vulnerable to symlink and path traversal races

CVSS 4.0 5.8 MEDIUMCheck source for fixed versionsKEV status unknown

Original advisory

cve-program · CVE-2026-54587

Published

mport is the MidnightBSD Package Manager. Prior to 2.7.8, directory assets handled as ASSET_DIR or ASSET_DIR_OWNER_MODE in libmport/bundle_read_install_pkg.c used path-based mport_mkdirp(), ownership, and permission operations. A local attacker able to modify part of the target installation tree could use dot-dot traversal or substitute symlinks during privileged package installation, causing directory creation or attribute changes to affect attacker-selected paths outside the intended package directories. This issue is fixed in version 2.7.8.

Read the publisher's advisory

Affected versions, risk and source history

cve-program · CVE-2026-54587

Published

mport

Vendor product

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "MidnightBSD",
                    "product": "mport",
                    "versions": [
                        {
                            "version": "< 2.7.8",
                            "status": "affected"
                        }
                    ]
                }

Original source record · Cite this exact observation · Complete original publisher JSON