CVE-2026-54584 is a vulnerability in the MidnightBSD Package Manager, mport, which used the TMPDIR environment variable during package metafile extraction, including in privileged contexts. This could allow an attacker to redirect temporary metadata extraction to a controlled location. The issue was patched in version 2.7.8. System administrators should verify their mport versions and update to 2.7.8 or l [truncated]
A vulnerability in the MidnightBSD Package Manager (mport) prior to version 2.7.8 allows for tampering with package index or package download traffic when a cleartext URL is configured or returned by mirror data. This issue is fixed in version 2.7.8. The vulnerability exists in the mport_fetch_index(), mport_fetch_bootstrap_index(), and mport_fetch_bundle() paths in libmport/fetch.c, where HTTPS enforceme [truncated]
The CVE-2026-54578 vulnerability affects the MidnightBSD Package Manager (mport), specifically in the mport_verify_package() function in libmport/verify.c. An attacker could influence the integrity result of installed files or hide checksum failures. Defenders should verify file integrity and assess exposure in affected systems. The issue is fixed in mport version 2.7.8. This vulnerability has a low CVSS [truncated]
A local attacker with write access to a target directory could exploit a vulnerability in mport, the MidnightBSD Package Manager, to compromise filesystem integrity or permissions by replacing a checked file with a symlink before privileged ownership or mode changes were applied. This issue allows attackers to potentially escalate privileges or manipulate system files, emphasizing the need for defenders t [truncated]
A local attacker with write access to a participating package cache or staging path could potentially redirect package downloads, cleanup, or install-related side effects outside the intended cache by exploiting a race condition in the mport package manager prior to version 2.7.8. This issue allows for unintended side effects due to improper path handling and shell-form invocation in privileged package fe [truncated]
