CVE-2026-54576

mport is the MidnightBSD Package Manager. Prior to 2.7.8, doactualinstall in libmport/bundlereadinstallpkg.c used path-based lstat, chown, stat, and chmod operations while installing package files. A local attacker with write access to a target directory could replace a checked file with a symlin...

CVE-2026-54576

mport , the MidnightBSD Package Manager, is affected by a symlink TOCTOU vulnerability in do_actual_install() (file libmport/bundle_read_install_pkg.c) prior to version 2.7.8 . The function used path-based lstat(), chown(), stat(), and chmod() operations during package installation. A local attac...

CVE-2026-54576 mport package installation has symlink TOCTOU in chown and chmod handling

mport is the MidnightBSD Package Manager. Prior to 2.7.8, doactualinstall in libmport/bundlereadinstallpkg.c used path-based lstat, chown, stat, and chmod operations while installing package files. A local attacker with write access to a target directory could replace a checked file with a symlin...