{"id":"CVE-2026-54582","title":"mport is the MidnightBSD Package Manager","summary":"mport is the MidnightBSD Package Manager. Prior to 2.7.8, package installation lacked a preflight check for incoming non-directory assets that already existed on disk. The affected logic across libmport/check_preconditions.c, libmport/in…","severity":"medium","cvss":6,"cvssVector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N","cwe":["CWE-73","CWE-668"],"vendor":"MidnightBSD","product":"mport","affected":["mport < 2.7.8"],"published":"2026-09-17","updated":"2026-09-17","sourceUpdated":"2026-09-17T21:15:06.427","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-54582","references":[{"url":"https://github.com/MidnightBSD/mport/commit/c643312d149dcc994957dbafa8f6f6b61e945e39","label":"security-advisories@github.com"},{"url":"https://github.com/MidnightBSD/mport/pull/131","label":"security-advisories@github.com"},{"url":"https://github.com/MidnightBSD/mport/releases/tag/2.7.8","label":"security-advisories@github.com"},{"url":"https://github.com/MidnightBSD/mport/security/advisories/GHSA-5773-7r4r-rpgx","label":"security-advisories@github.com"}],"tags":["nvd","cve.org"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2026-09-17T19:15:39.206598Z"},"cvssSource":"cna","ingestedAt":"2026-09-17T17:23:30.629Z","epss":0.00531,"epssPercentile":0.43612,"slug":"CVE-2026-54582","body":"## Overview\n\nmport is the MidnightBSD Package Manager. Prior to 2.7.8, package installation lacked a preflight check for incoming non-directory assets that already existed on disk. The affected logic across libmport/check_preconditions.c, libmport/install_primative.c, and libmport/mport_private.h did not apply MPORT_PRECHECK_FILE_CONFLICTS, so a crafted or conflicting package could overwrite a file owned by another package or unmanaged by mport. The check is bypassed only when the operator explicitly enables mport->force. Privileged installation without that override could compromise local filesystem integrity and package database consistency. This issue is fixed in version 2.7.8.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":33,"depthScoreParts":{"impact":33,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}