{"id":"CVE-2026-54575","summary":"mport package fetch and clean paths are vulnerable to TOCTOU filesystem races","details":"mport is the MidnightBSD Package Manager. Prior to 2.7.8, privileged package fetch and cache-cleaning operations used race-prone path handling across libmport/fetch.c, libmport/clean.c, libmport/util.c, libmport/bundle_read_install_pkg.c, libmport/delete_primative.c, and libexec/mport.create/mport.create.c. A local attacker with write access to a participating package cache or staging path could race path checks and replacement operations to redirect package downloads, cleanup, or install-related side effects outside the intended cache. The affected lifecycle helper paths also used shell-form invocation, increasing command-line interpretation risk during privileged helper execution. This issue is fixed in version 2.7.8.","aliases":["GHSA-h387-g4pf-28cj"],"modified":"2026-09-23T08:12:40.905486Z","published":"2026-09-17T16:55:19.349Z","database_specific":{"cna_assigner":"GitHub_M","cwe_ids":["CWE-367","CWE-78"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/54xxx/CVE-2026-54575.json"},"references":[{"type":"WEB","url":"https://github.com/MidnightBSD/mport/releases/tag/2.7.8"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/54xxx/CVE-2026-54575.json"},{"type":"ADVISORY","url":"https://github.com/MidnightBSD/mport/security/advisories/GHSA-h387-g4pf-28cj"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-54575"},{"type":"FIX","url":"https://github.com/MidnightBSD/mport/commit/29154b0fdfb5806568ed1277e88d942bad6d1169"},{"type":"FIX","url":"https://github.com/MidnightBSD/mport/pull/118"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/midnightbsd/mport","events":[{"introduced":"0"},{"fixed":"29154b0fdfb5806568ed1277e88d942bad6d1169"},{"fixed":"899c8fe2d3ceb25d899e70dbd0c7744b7d7a0946"}],"database_specific":{"extracted_events":[{"introduced":"0"},{"fixed":"2.7.8"}],"source":["AFFECTED_FIELD","REFERENCES"]}}],"versions":["2.7.6","2.7.5","2.7.4","2.7.3","2.7.2","2.7.1","2.7.0","2.6.8","2.6.7","2.6.5","2.6.4","2.6.3","2.6.2","2.6.1","2.6.0","2.5.1","2.5.0","2.4.8","2.4.7","2.4.6","2.4.5","2.4.4","2.4.3","2.4.1","2.4.0","2.3.0","2.2.9.1","2.2.9","2.2.8","2.2.7","2.2.6","2.2.5","2.2.4","2.2.3","2.2.2","2.2.1","2.2.0","2.1.9","2.1.8","2.1.7","2.1.6","2.1.5","2.1.4","2.1.3","2.1.2","2.1.1","2.1.0","2.0.9","2.0.8","2.0.7","2.0.6","2.0.5","2.0.2","2.0.1","2.0"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-54575.json","vanir_signatures_modified":"2026-09-23T08:12:40Z","vanir_signatures":[{"deprecated":false,"digest":{"function_hash":"137147513844556653286257173365204246305","length":3111},"id":"CVE-2026-54575-07c0b4f3","signature_type":"Function","signature_version":"v1","source":"https://github.com/midnightbsd/mport/commit/29154b0fdfb5806568ed1277e88d942bad6d1169","target":{"file":"libmport/bundle_read_install_pkg.c","function":"run_postexec"}},{"id":"CVE-2026-54575-0f14b3f2","signature_type":"Line","signature_version":"v1","source":"https://github.com/midnightbsd/mport/commit/29154b0fdfb5806568ed1277e88d942bad6d1169","target":{"file":"libmport/util.c"},"deprecated":false,"digest":{"line_hashes":["11475394956103522402116063072573479198","82518725333171253607684251606111865292","194057341659971384192826542681178757911","283609510767792579895051993485750004175","266495938401102147718363258000098303341","317180760618573174452889184536947063404","230135801159721268404622794599816406040","50389821107726732622176736042534794498"],"threshold":0.9}},{"digest":{"function_hash":"284734007778760443162667545468136739063","length":1468},"id":"CVE-2026-54575-14323c05","signature_type":"Function","signature_version":"v1","source":"https://github.com/midnightbsd/mport/commit/29154b0fdfb5806568ed1277e88d942bad6d1169","target":{"file":"libmport/clean.c","function":"mport_clean_oldpackages"},"deprecated":false},{"signature_version":"v1","source":"https://github.com/midnightbsd/mport/commit/29154b0fdfb5806568ed1277e88d942bad6d1169","target":{"file":"libmport/clean.c"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["325563250280491047769144344096977359668","236161134873429206371803749555872893196","208889543989266265367884391559527029486","133283934139292109385832220192907328594","155872470121518015594218715094056913254","269378485072915356215320276668735052464","5316932000849359108626175380815596285","16031932911180592321887445657166123324","208175863603321890253074347466169904645","206982278777018453453222984517186234722","169273049038674411470588711753266213081","67215574788174529810781006755920579612","285126239035342642279759887525895226608","287458674147009568199892472927644587339","218895761384147179033818677526315398061","302244057174011214793448553407445810979","186056039197841567056151062912337777036","328333636949795718123690384976955274837","19233288683258423059592547988330508052","83269392866936518191520299547753012365","76615553519474527846297032622078948708","224604867986062375022227112618870187232","140136508266464455310954479065266416155","146616373002724380220903730379866318042","1557194798454374935090740188873939523","77801013656563352805679587737952706312","83269392866936518191520299547753012365","166411911589509259360096167264651858430","184071668103401961435056377995944536711","56483609886518940103909260521161746370","120926031864092392324105001723735694727","289205194212227524585427926479218402659","5572809954774288349903461534763570201","17329278601590705379445668921319801039","182013381953606000354412515067013954271","49450908690704678759810942503798398307","105812431824231571071044908441026261779","60081857684541333386960372325364929482"]},"id":"CVE-2026-54575-1b59b03c","signature_type":"Line"},{"id":"CVE-2026-54575-2066a907","signature_type":"Function","signature_version":"v1","source":"https://github.com/midnightbsd/mport/commit/29154b0fdfb5806568ed1277e88d942bad6d1169","target":{"file":"libmport/fetch.c","function":"mport_fetch_bundle"},"deprecated":false,"digest":{"function_hash":"79616791461066690541790871307003249497","length":1357}},{"source":"https://github.com/midnightbsd/mport/commit/29154b0fdfb5806568ed1277e88d942bad6d1169","target":{"file":"libmport/fetch.c","function":"mport_fetch_cves"},"deprecated":false,"digest":{"function_hash":"292232835223173317997676878790821823561","length":589},"id":"CVE-2026-54575-33f92310","signature_type":"Function","signature_version":"v1"},{"digest":{"line_hashes":["283163510412534374420012661433197507863","35648646127066072481245412860481828700","75393662308506708193823591903378044687","110399029476620483993731882787875713283","249629689439193113038331323696003095775","63000575414284801773203645570643786369","5013729878558058226327469261623901997","200463280322146119628044556303489564499","308275869405597491506237188213191633172","219429411368227880001850668368369041553","179537493954563637482149109356288072937","215724110006590291181974107952814272321","132838055168236112835315797800664218794","150359928581453132013938972713599093126","154920866838150818642117239901086002883","198927089155622263521776161654447146633","165189412624629748569914101415828094787"],"threshold":0.9},"id":"CVE-2026-54575-48f2a2fc","signature_type":"Line","signature_version":"v1","source":"https://github.com/midnightbsd/mport/commit/29154b0fdfb5806568ed1277e88d942bad6d1169","target":{"file":"libexec/mport.create/mport.create.c"},"deprecated":false},{"target":{"file":"libmport/fetch.c","function":"fetch"},"deprecated":false,"digest":{"function_hash":"196537778812890803607086079752017476332","length":370},"id":"CVE-2026-54575-49cee073","signature_type":"Function","signature_version":"v1","source":"https://github.com/midnightbsd/mport/commit/29154b0fdfb5806568ed1277e88d942bad6d1169"},{"deprecated":false,"digest":{"function_hash":"127932989124905786489690233828707457862","length":1534},"id":"CVE-2026-54575-4f2949b1","signature_type":"Function","signature_version":"v1","source":"https://github.com/midnightbsd/mport/commit/29154b0fdfb5806568ed1277e88d942bad6d1169","target":{"file":"libmport/fetch.c","function":"fetch_to_file"}},{"signature_version":"v1","source":"https://github.com/midnightbsd/mport/commit/29154b0fdfb5806568ed1277e88d942bad6d1169","target":{"file":"libmport/fetch.c"},"deprecated":false,"digest":{"line_hashes":["299265668396515864454367249725043152686","104911725553081760902941758742288349350","280027914466497646518379172550041198945","235179357180816855828103148401969473601","61151361812142113535869483713320378404","119285109845885236512443640274217671804","38908226630373385094202273864559867346","161633134915310969975383656424609297543","158479975931778206198242654295898960720","15387072054669734644261243247886106123","133892459072083499930332743822107016475","44469295458219203573512937657392086068","270387958602248974094766528082243728362","49047591699216750517399219286143653783","222871352220422123569664914456699094396","178377636822841131569424730731554495325","300162368750500673994145667367937493920","224890912158991780052360343661012413197","208557140938536677546327371311918288273","110207590087645891989583272510794511675","320536240200403751378916945796635535801","15660436912926760241270486585905213539","25152035473082630452507411338228358626","25555597970778016476123181507681966191","331447711862903761098944402402174449036","128968035690692146926491421415334097094","292185601818289251625488408306324890572","109017486733079749635017546041894452219","30243772262386043236747070056175620100","5252929099948960213346721281378380751","266857221552513330724286858449856931067","183923230424222138948238706712402935947","193716665306928967768597322465195606293","55289425536363799072413991210025813798","21867423908327619960332554234031936832","170166021785567918765634924539906128853","51325238770242704341886859060058651563","118885306099877669603092065799976741634","35344385144277850233283314259012488384","222928403297795584114446574583433505965","172741545749707074439655177173521524842","185568572071453513164386392304895247034","106824913099355809270070344467882842019","18649511088243584395082365379134971534","25266512708181128324763740626888696411","79389990024587830556655455156109043469","145550600636286575767527251256526029229","263499342341460684541623801364163621807","283382406643442269739922951707850995120","319059499567953399278231240694866461812","24946436942547336012036395274187657654","308654825009756580001432165045742613837","207508426613554225326509635570136741338","201339814106422755555918966258393449132","200502316999305849332428106953389931369","320099820143326854002759360986928774487","306375597330542481364944346898121528755","99660230946440346439155050003271657315","59283955883958399648471016201651287573","28099082558114222584750332947550501599","226670967935846732931369131003204082156","29561794097234387146930990116983621318","309968931805795150451250191771116160698","276297246033792164815656242451967493569","127285583876751085673339939147613618988","273088098643832568111941502398164935052","336757296528162151826480092218670571831","165722182767484665884694916874293756558","79284300392053841821453534022558304916","178289021412197807538182237668714932060","29242375430240441596901912490207745527","187136315953138502438148460565340683213","330350707885559431412372520612064704834","59664477377884150951733527836187552291","137291109937012765801844844263973762029","19786714923097366832027260941166116265"],"threshold":0.9},"id":"CVE-2026-54575-5427b296","signature_type":"Line"},{"signature_version":"v1","source":"https://github.com/midnightbsd/mport/commit/29154b0fdfb5806568ed1277e88d942bad6d1169","target":{"file":"libexec/mport.create/mport.create.c","function":"usage"},"deprecated":false,"digest":{"length":1124,"function_hash":"255154916321466067701208374074883332561"},"id":"CVE-2026-54575-63c3d016","signature_type":"Function"},{"digest":{"function_hash":"140449510668304095223619144515714315799","length":3688},"id":"CVE-2026-54575-6e778842","signature_type":"Function","signature_version":"v1","source":"https://github.com/midnightbsd/mport/commit/29154b0fdfb5806568ed1277e88d942bad6d1169","target":{"function":"main","file":"libexec/mport.create/mport.create.c"},"deprecated":false},{"target":{"file":"libmport/delete_primative.c"},"deprecated":false,"digest":{"line_hashes":["315871945396811033882106706528904341139","205072407764402070792446707234005548299","206626859862931916135182419958591865018","264874043679692597708643195244548876458","159757427149591394962685756713355691075","34282681640189605757810493788579331347","131247833711789289984934102551513001980","160349090466886823340636468078120838318","75953499778805722264665640652630063523","121898190934624501302172536700515282400","130154592146357048406494702012417030709","163718054988051457206948734703463032109","260253245832933644495325604882506999827","163390330017406173868514175977017836495","273044645211350846033584871890401335473","309209375248919462498417159410910230655","247037980998505698851123749836255952119","339977268086062062120101577866071771353","101282644783396893025610523010848890024","102142055529247352087754297073815348127","108388609124094819780446096110356726475","199250082746588882805361828876988717473","335935009146687890933626436166666971459","224922688278539261119178632271043749678","126792832584683983998453181475877307648","261038500821720978244429922342321379256","26824036105809985504123091065295559541","146667452104293499227430772865084324455","15396053916742764011660027475232235628","335716214532776434024165671018420388192","73659192437725043366486812073069345346","55960890775256301089032401534606167185","242805029190307479051832610418713282092","38032096832667471142657634685172499211","333136714132823465634104844688513257601","26577712574517579139944740395378343980","85778428466720498262386640238016461920","175405982758443868094558927547505572855","287011073948031623649090486818131546953","219272339409928623466946340700757741855","127752626037007765089023398361115127130","133981743377066797332834499337476608397","321438274118850358655622567125906085271","162214969112094234104600028668700391636","5152919645880706445138477326421160042","129903977592359420088369322853761712541","255574919383758148512638091526341169144"],"threshold":0.9},"id":"CVE-2026-54575-8483823d","signature_type":"Line","signature_version":"v1","source":"https://github.com/midnightbsd/mport/commit/29154b0fdfb5806568ed1277e88d942bad6d1169"},{"target":{"file":"libmport/delete_primative.c","function":"run_unldconfig"},"deprecated":false,"digest":{"function_hash":"306371832968666090312630438466972756373","length":1388},"id":"CVE-2026-54575-88faab68","signature_type":"Function","signature_version":"v1","source":"https://github.com/midnightbsd/mport/commit/29154b0fdfb5806568ed1277e88d942bad6d1169"},{"id":"CVE-2026-54575-9512bf70","signature_type":"Line","signature_version":"v1","source":"https://github.com/midnightbsd/mport/commit/29154b0fdfb5806568ed1277e88d942bad6d1169","target":{"file":"libmport/bundle_read_install_pkg.c"},"deprecated":false,"digest":{"line_hashes":["36009377738662038206778955267665086931","233234506501756335644211890708711651427","251727539547009848022010424149121420972","20631198764540432707060667750792861825","323467244543209055678315655484099312459","200057989913668198480386071671041843462","169432206632994185758795744833166096498","279910223460901576245618569992303209059","116852150482093079532409496689308786787","11403454858384607525695189268163563813","242358838455269554516980887876632863347","56045068332679442305967246698467234346","26577712574517579139944740395378343980","181381898631054431832052555124023913845","113916168192479078332792977730687666844","66451428298605833654807593106594746964","48915499303145983397864696508754486245","127752626037007765089023398361115127130","262893196626514595503726839461490510461","299490719088564627083545520104421706885","291735287502645414074315869414750168322","130181859504663765638912979360894020710"],"threshold":0.9}},{"signature_version":"v1","source":"https://github.com/midnightbsd/mport/commit/29154b0fdfb5806568ed1277e88d942bad6d1169","target":{"file":"libmport/mport_private.h"},"deprecated":false,"digest":{"line_hashes":["302956968718453474809507540325127881458","194639926327913618753942248538500004577","33050952978603889608833165093248204495","140706362150222479376613479133694014013"],"threshold":0.9},"id":"CVE-2026-54575-b7e978c9","signature_type":"Line"},{"deprecated":false,"digest":{"function_hash":"191027468455084880700878892091254332962","length":2213},"id":"CVE-2026-54575-c31388ba","signature_type":"Function","signature_version":"v1","source":"https://github.com/midnightbsd/mport/commit/29154b0fdfb5806568ed1277e88d942bad6d1169","target":{"file":"libmport/delete_primative.c","function":"run_special_unexec"}}]}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N"}]}