CVE-2026-54584

— UNSCOREDpublic exploit available

Published 2026-09-21 · Updated 2026-09-21

AI analysis for this CVE has not been generated yet. Raw NVD data is shown below.

NVD description

mport is the MidnightBSD Package Manager. mport before 2.7.8 used TMPDIR while extracting package metafiles, including when running as root or in setuid/setgid contexts. An attacker able to control the environment for a privileged mport invocation could redirect temporary metadata extraction to an attacker-controlled location. PR 123 ignores unsafe TMPDIR values in privileged contexts and rejects empty TMPDIR. This issue has been patched in version 2.7.8.

Weaknesses

CWE-73, CWE-377

Public exploit & PoC references

https://github.com/MidnightBSD/mport/commit/3790fa49a36cb085f48b204ef189fb82bbee621a
https://github.com/MidnightBSD/mport/pull/123
https://github.com/MidnightBSD/mport/releases/tag/2.7.8
https://github.com/MidnightBSD/mport/security/advisories/GHSA-4vv3-3h8r-q6mq

All references

https://github.com/MidnightBSD/mport/commit/3790fa49a36cb085f48b204ef189fb82bbee621a
https://github.com/MidnightBSD/mport/pull/123
https://github.com/MidnightBSD/mport/releases/tag/2.7.8
https://github.com/MidnightBSD/mport/security/advisories/GHSA-4vv3-3h8r-q6mq

Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.

Related CVEs

HIGHCVE-2026-15307PoC
LOWCVE-2026-16791
HIGHCVE-2026-18806
MEDIUMCVE-2026-19860
HIGHCVE-2026-53940PoC
HIGHCVE-2026-60009PoC
UNSCOREDCVE-2026-61647PoC
CRITICALCVE-2026-90817

Related by shared AI tags and CWE weakness class. Browse the full archive.