CVE-2026-54584CWE-377CWE-73

CVE-2026-54584

published September 21, 2026

CVSS
5.3
EPSS
0%
Percentile
39.4
In the wild
Unconfirmed
What it is

mport is the MidnightBSD Package Manager. mport before 2.7.8 used TMPDIR while extracting package metafiles, including when running as root or in setuid/setgid contexts. An attacker able to control the environment for a privileged mport invocation could redirect temporary metadata extraction to an attacker-controlled location. PR 123 ignores unsafe TMPDIR values in privileged contexts and rejects empty TMPDIR. This issue has been patched in version 2.7.8.

The record
Technical detail
CVSS
5.3 · NONE
CVSS v4.0
5.3 · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
EPSS
0.00466 · 39.4th percentile
Weaknesses
CWE-377 · Insecure Temporary File; CWE-73 · External Control of File Name or Path
Published
2026-09-21T19:17Z
References (4)
https://github.com/MidnightBSD/mport/commit/3790fa49a36cb085f48b204ef189fb82bbee621a · [email protected]https://github.com/MidnightBSD/mport/pull/123 · [email protected]https://github.com/MidnightBSD/mport/releases/tag/2.7.8 · [email protected]https://github.com/MidnightBSD/mport/security/advisories/GHSA-4vv3-3h8r-q6mq · [email protected]
EPSS history
Timeline
  • 23 SEP 03:46Z
    EPSS moved — → 0%
    epss
  • 21 SEP 14:05Z
    mport trusts environment-controlled temporary directories in privileged metadata extraction
    cvelistv5