VulnerabilityDeferred

CVE-2026-54584

An attacker able to control the environment for a privileged mport invocation could redirect temporary metadata extraction to an attacker-controlled location.

MEDIUM 5.3EPSS 0.47%

Does this matter?

Lower severity and a low EPSS score (0.47%). Track it; it rarely justifies an emergency change on its own.

Description

mport is the MidnightBSD Package Manager. mport before 2.7.8 used TMPDIR while extracting package metafiles, including when running as root or in setuid/setgid contexts. An attacker able to control the environment for a privileged mport invocation could redirect temporary metadata extraction to an attacker-controlled location. PR 123 ignores unsafe TMPDIR values in privileged contexts and rejects empty TMPDIR. This issue has been patched in version 2.7.8.

CVSS 4.0: 5.3 MEDIUMCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/M
EPSS: 0.47% probability · 40th percentile
Public exploits: None in Exploit-DB
CISA KEV: Not listed
Weakness: CWE-73, CWE-377
Source: security-advisories@github.com

EPSS trend

EPSS moved from 0.3% on 22 September 2026 to 0.5% on 26 October 2026.

References

Source: NVD record, EPSS from FIRST.org, KEV from CISA, exploits from Exploit-DB. Refreshed daily. Download this record as JSON.