{"id":"CVE-2026-54584","summary":"mport trusts environment-controlled temporary directories in privileged metadata extraction","details":"mport is the MidnightBSD Package Manager. mport before 2.7.8 used TMPDIR while extracting package metafiles, including when running as root or in setuid/setgid contexts. An attacker able to control the environment for a privileged mport invocation could redirect temporary metadata extraction to an attacker-controlled location. PR 123 ignores unsafe TMPDIR values in privileged contexts and rejects empty TMPDIR. This issue has been patched in version 2.7.8.","aliases":["GHSA-4vv3-3h8r-q6mq"],"modified":"2026-09-25T08:27:30.153281Z","published":"2026-09-21T14:05:48.447Z","database_specific":{"cna_assigner":"GitHub_M","cwe_ids":["CWE-377","CWE-73"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/54xxx/CVE-2026-54584.json"},"references":[{"type":"WEB","url":"https://github.com/MidnightBSD/mport/releases/tag/2.7.8"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/54xxx/CVE-2026-54584.json"},{"type":"ADVISORY","url":"https://github.com/MidnightBSD/mport/security/advisories/GHSA-4vv3-3h8r-q6mq"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-54584"},{"type":"FIX","url":"https://github.com/MidnightBSD/mport/commit/3790fa49a36cb085f48b204ef189fb82bbee621a"},{"type":"FIX","url":"https://github.com/MidnightBSD/mport/pull/123"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/midnightbsd/mport","events":[{"introduced":"0"},{"fixed":"899c8fe2d3ceb25d899e70dbd0c7744b7d7a0946"},{"fixed":"3790fa49a36cb085f48b204ef189fb82bbee621a"}],"database_specific":{"extracted_events":[{"introduced":"0"},{"fixed":"2.7.8"}],"source":["DESCRIPTION","REFERENCES"]}}],"versions":["2.7.6","2.7.5","2.7.4","2.7.3","2.7.2","2.7.1","2.7.0","2.6.8","2.6.7","2.6.5","2.6.4","2.6.3","2.6.2","2.6.1","2.6.0","2.5.1","2.5.0","2.4.8","2.4.7","2.4.6","2.4.5","2.4.4","2.4.3","2.4.1","2.4.0","2.3.0","2.2.9.1","2.2.9","2.2.8","2.2.7","2.2.6","2.2.5","2.2.4","2.2.3","2.2.2","2.2.1","2.2.0","2.1.9","2.1.8","2.1.7","2.1.6","2.1.5","2.1.4","2.1.3","2.1.2","2.1.1","2.1.0","2.0.9","2.0.8","2.0.7","2.0.6","2.0.5","2.0.2","2.0.1","2.0"],"database_specific":{"vanir_signatures_modified":"2026-09-25T08:27:30Z","vanir_signatures":[{"id":"CVE-2026-54584-634324d3","signature_type":"Line","signature_version":"v1","source":"https://github.com/midnightbsd/mport/commit/3790fa49a36cb085f48b204ef189fb82bbee621a","target":{"file":"libmport/bundle_read.c"},"deprecated":false,"digest":{"line_hashes":["119957359405669945120030440606740727674","256165556245632309551915136949878708254","74989649815960105708835506530771921140","50614597987925468949691210108052772837","235708484124317822188039213208353554795","22259209027797341990053315092248903864","198471845428013664164575852610006057056","306880740727173123494435494042408803526","115503530811073493255853405450937932669"],"threshold":0.9}},{"id":"CVE-2026-54584-afe86c4f","signature_type":"Function","signature_version":"v1","source":"https://github.com/midnightbsd/mport/commit/3790fa49a36cb085f48b204ef189fb82bbee621a","target":{"file":"libmport/bundle_read.c","function":"mport_bundle_read_extract_metafiles"},"deprecated":false,"digest":{"function_hash":"338998570603308789551057811450505152398","length":909}}],"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-54584.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N"}]}