---
id: CVE-2026-54584
title: mport is the MidnightBSD Package Manager
summary: >-
  mport is the MidnightBSD Package Manager. mport before 2.7.8 used TMPDIR while
  extracting package metafiles, including when running as root or in
  setuid/setgid contexts. An attacker able to control the environment for a
  privileged mport …
severity: medium
cvss: 5.3
cvssVector: 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N'
cwe:
  - CWE-73
  - CWE-377
vendor: MidnightBSD
product: mport
affected:
  - mport < 2.7.8
published: '2026-09-21'
updated: '2026-09-21'
sourceUpdated: '2026-09-21T15:17:29.107'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-54584'
references:
  - url: >-
      https://github.com/MidnightBSD/mport/commit/3790fa49a36cb085f48b204ef189fb82bbee621a
    label: security-advisories@github.com
  - url: 'https://github.com/MidnightBSD/mport/pull/123'
    label: security-advisories@github.com
  - url: 'https://github.com/MidnightBSD/mport/releases/tag/2.7.8'
    label: security-advisories@github.com
  - url: >-
      https://github.com/MidnightBSD/mport/security/advisories/GHSA-4vv3-3h8r-q6mq
    label: security-advisories@github.com
tags:
  - nvd
  - cve.org
cvssSource: cna
ingestedAt: '2026-09-21T14:38:56.372Z'
---

## Overview

mport is the MidnightBSD Package Manager. mport before 2.7.8 used TMPDIR while extracting package metafiles, including when running as root or in setuid/setgid contexts. An attacker able to control the environment for a privileged mport invocation could redirect temporary metadata extraction to an attacker-controlled location. PR 123 ignores unsafe TMPDIR values in privileged contexts and rejects empty TMPDIR. This issue has been patched in version 2.7.8.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.