CVE-2026-54585

— UNSCOREDpublic exploit available

Published 2026-09-17 · Updated 2026-09-17

AI analysis for this CVE has not been generated yet. Raw NVD data is shown below.

NVD description

mport is the MidnightBSD Package Manager. Prior to 2.7.8, create_sample_file() in libmport/bundle_read_install_pkg.c did not constrain absolute source and destination paths from the sample-file manifest directive to mport->root. A malicious or malformed package manifest could therefore direct privileged sample-file handling to copy or write outside the configured installation root, compromising local filesystem integrity. This issue is fixed in version 2.7.8.

Weaknesses

CWE-22

Public exploit & PoC references

https://github.com/MidnightBSD/mport/commit/36a42c8ddbd23ee9eb72c4c17596eb92cb423cf0
https://github.com/MidnightBSD/mport/pull/122
https://github.com/MidnightBSD/mport/releases/tag/2.7.8
https://github.com/MidnightBSD/mport/security/advisories/GHSA-xqjc-rxmm-p27v

All references

https://github.com/MidnightBSD/mport/commit/36a42c8ddbd23ee9eb72c4c17596eb92cb423cf0
https://github.com/MidnightBSD/mport/pull/122
https://github.com/MidnightBSD/mport/releases/tag/2.7.8
https://github.com/MidnightBSD/mport/security/advisories/GHSA-xqjc-rxmm-p27v

Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.

Related CVEs

HIGHCVE-2017-20284
MEDIUMCVE-2024-58386PoC
MEDIUMCVE-2025-1280
HIGHCVE-2025-1281
HIGHCVE-2025-14753
HIGHCVE-2026-100372PoC
HIGHCVE-2026-100520PoC
MEDIUMCVE-2026-100533PoC

Related by shared AI tags and CWE weakness class. Browse the full archive.