CVE-2026-54582: midnightbsd mport External Control of File Name or Path

Vulnerability summary

CVE-2026-54582 is a medium (CVSS 6.0) External Control of File Name or Path vulnerability in midnightbsd mport. EPSS estimates a 0.55% chance of exploitation in the next 30 days, higher than 45.1% of scored vulnerabilities.

Timeline

1. 17-09-2026
   PublishedVulnerability first disclosed.
2. 17-09-2026
   Last modifiedVulnerability information updated.

Description

mport is the MidnightBSD Package Manager. Prior to 2.7.8, package installation lacked a preflight check for incoming non-directory assets that already existed on disk. The affected logic across libmport/check_preconditions.c, libmport/install_primative.c, and libmport/mport_private.h did not apply MPORT_PRECHECK_FILE_CONFLICTS, so a crafted or conflicting package could overwrite a file owned by another package or unmanaged by mport. The check is bypassed only when the operator explicitly enables mport->force. Privileged installation without that override could compromise local filesystem integrity and package database consistency. This issue is fixed in version 2.7.8.

• CWE-73External Control of File Name or PathThe product allows user input to control or influence paths or file names that are used in filesystem operations.
• CWE-668Exposure of Resource to Wrong SphereThe product exposes a resource to the wrong control sphere, providing unintended actors with inappropriate access to the resource.