CVE-2026-54587

mport is the MidnightBSD Package Manager. Prior to 2.7.8, directory assets handled as ASSETDIR or ASSETDIROWNERMODE in libmport/bundlereadinstallpkg.c used path-based mportmkdirp, ownership, and permission operations. A local attacker able to modify part of the target installation tree could use...

CVE-2026-54585

mport is the MidnightBSD Package Manager. Prior to 2.7.8, createsamplefile in libmport/bundlereadinstallpkg.c did not constrain absolute source and destination paths from the sample-file manifest directive to mport-root. A malicious or malformed package manifest could therefore direct privileged...

EUVD-2026-82328

mport is the MidnightBSD Package Manager. Prior to 2.7.8, directory assets handled as ASSETDIR or ASSETDIROWNERMODE in libmport/bundlereadinstallpkg.c used path-based mportmkdirp, ownership, and permission operations. A local attacker able to modify part of the target installation tree could use...

CVE-2026-54587

mport , the MidnightBSD Package Manager, is vulnerable to symlink and path traversal races in versions prior to 2.7.8 . The flaw resides in libmport/bundle_read_install_pkg.c, where directory assets (ASSET_DIR / ASSET_DIR_OWNER_MODE) used path-based mport_mkdirp(), ownership, and permission opera...