CVE-2026-54584: mport Package Manager Privilege Escalation

CVE-2026-54584 Overview

CVE-2026-54584 affects mport, the MidnightBSD Package Manager, in versions prior to 2.7.8. The package manager honored the TMPDIR environment variable when extracting package metafiles, even when running as root or in setuid/setgid contexts. An attacker able to control the environment for a privileged mport invocation could redirect temporary metadata extraction to an attacker-controlled location. The flaw is categorized under [CWE-73: External Control of File Name or Path]. MidnightBSD patched the issue in mport 2.7.8 via Pull Request #123, which ignores unsafe TMPDIR values in privileged contexts and rejects empty TMPDIR values.

Critical Impact
A local attacker controlling the environment of a privileged mport process can redirect metafile extraction, enabling file placement in attacker-controlled paths during package operations.

Affected Products

MidnightBSD mport versions prior to 2.7.8
MidnightBSD systems running package operations as root
MidnightBSD tooling invoking mport in setuid/setgid contexts

Discovery Timeline

2026-09-21 - CVE-2026-54584 published to NVD
2026-09-23 - Last updated in NVD database

Technical Details for CVE-2026-54584

Vulnerability Analysis

The vulnerability resides in the metafile extraction routine of libmport, specifically in bundle_read.c. mport determines the temporary directory for extracting package metadata by reading the TMPDIR environment variable. When the process runs with elevated privileges, the code did not sanitize or reject untrusted TMPDIR values inherited from a lower-privileged invoker. This allows an attacker to steer file creation into a directory they control, which can result in file overwrites, symlink attacks, or manipulation of subsequent package operations that consume the extracted metadata.

Root Cause

The root cause is external control of a file path element without validation in a privileged context. mport trusted the TMPDIR environment variable during package metafile extraction, including when executing as root or in setuid/setgid modes. Environment variables inherited across a privilege boundary are attacker-controlled input and require validation before use in filesystem operations.

Attack Vector

An attacker with the ability to set environment variables for a privileged mport invocation supplies a malicious TMPDIR value. When the privileged process extracts metafiles, files are created under the attacker-controlled path. Combined with symlink placement, this can be leveraged to write, truncate, or clobber files outside the intended temporary location, affecting the integrity of the packaging workflow.

 #include <string.h>
 #include <errno.h>
 #include <archive_entry.h>
+#include <unistd.h>
 
 /*
  * mport_bundle_read_new()

Source: MidnightBSD commit 3790fa4. The patch introduces <unistd.h> to enable privilege checks (geteuid, getuid, getegid, getgid) and hardens tempdir selection so that unsafe TMPDIR values are ignored in privileged contexts.

Detection Methods for CVE-2026-54584

Indicators of Compromise

Unexpected files or directories appearing under attacker-writable paths referenced by TMPDIR during package installs or upgrades.
Package operations invoked with an unusual or non-default TMPDIR value in the process environment.
Symbolic links present in temporary directories that resolve to sensitive system paths at the time of mport execution.

Detection Strategies

Audit shell histories, cron jobs, and orchestration scripts for mport invocations that pass or export TMPDIR.
Inspect installed mport versions across MidnightBSD hosts and flag any release earlier than 2.7.8.
Enable filesystem auditing on paths written by root-owned mport processes to identify writes outside /var/tmp or /tmp.

Monitoring Recommendations

Forward package manager execution logs and environment metadata to a centralized log store for review.
Alert on privilege transitions where inherited environment variables include TMPDIR pointing to non-standard directories.
Track file creation events by UID 0 processes into user-writable directories as a high-signal indicator.

How to Mitigate CVE-2026-54584

Immediate Actions Required

Upgrade mport to version 2.7.8 or later on all MidnightBSD systems.
Review privileged automation and remove any explicit TMPDIR exports that are not required for package operations.
Restrict who can invoke mport with elevated privileges and audit sudo policies accordingly.

Patch Information

The issue is fixed in mport release 2.7.8. The corrective change lands in Pull Request #123 and commit 3790fa4. Full details are documented in the MidnightBSD Security Advisory GHSA-4vv3-3h8r-q6mq.

Workarounds

Explicitly unset or reset TMPDIR before running mport as root until the patched version is deployed.
Configure sudo to sanitize the environment using env_reset and avoid preserving TMPDIR via env_keep.
Ensure /tmp and /var/tmp follow standard permissions and sticky-bit settings to reduce symlink attack surface.

bash

# Sanitize the environment when running mport with elevated privileges
unset TMPDIR
sudo -H mport install <package>

# In /etc/sudoers ensure the environment is reset
Defaults env_reset