# CVE-2026-54576: MidnightBSD mport symlink TOCTOU in package installation

Source: https://junglewise.ai/threats/cve-2026-54576-midnightbsd-mport-symlink-toctou-in-package-installation  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-17. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-54576 · Severity: info · CVSS 5.5 · Published 2026-09-17

mport is MidnightBSD's package manager, responsible for installing software on the system. Prior to version 2.7.8, a local attacker with write access to package installation directories could exploit a race condition to swap installed files with symlinks, causing the package manager to apply ownership and permission changes to attacker-selected files on the system. This could compromise filesystem permissions and integrity, potentially enabling privilege escalation for packages installed into world-writable directories.

Technologies: [MidnightBSD Mport](https://junglewise.ai/threats/technologies/mport). Vendors: [MidnightBSD](https://junglewise.ai/threats/vendors/midnightbsd).

## Quick answers

**Is CVE-2026-54576 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-54576 being exploited in the wild.

**How severe is CVE-2026-54576?** Informational severity, with a CVSS score of 5.5, published 17 September 2026.

**Which products and versions are affected?** MidnightBSD Mport before 2.7.8.

**Is there a fix for CVE-2026-54576?** A patch was published on 2026-05-31: Fix merged in commit 4676ac0; version 2.7.8 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-54576 attacked?** It is attacked with local access.

**Am I affected by CVE-2026-54576?** Check whether you run MidnightBSD Mport at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is a time-of-check-time-of-use (TOCTOU) race condition in do_actual_install() within libmport/bundle_read_install_pkg.c. The installer used path-based lstat(), chown(), stat(), and chmod() operations in sequence when applying ownership and permission metadata to extracted package files. An attacker with write access to a target directory could replace a regular file with a symlink between the lstat() check and the chown()/chmod() calls, causing the privileged operations to follow the symlink and modify an arbitrary file. The fix hardens the code by opening extracted files with O_NOFOLLOW and using descriptor-based fstat(), fchown(), and fchmod() operations instead, preventing symlink traversal and closing the race window. Version 2.7.8 and later include this fix.

## Affected products

- MidnightBSD mport before 2.7.8

## Timeline

- 2026-05-31: disclosed
- 2026-05-31: patched: Fix merged in commit 4676ac0; version 2.7.8 released
- 2026-09-17: advisory

## References

- [https://github.com/MidnightBSD/mport/commit/4676ac05b1056b54a3d38d03ae8a478bf12c9abe](https://github.com/MidnightBSD/mport/commit/4676ac05b1056b54a3d38d03ae8a478bf12c9abe)
- [https://github.com/MidnightBSD/mport/pull/150](https://github.com/MidnightBSD/mport/pull/150)

## Related threats

- [mport insecure TMPDIR usage in privileged contexts](https://junglewise.ai/threats/cve-2026-54584-mport-is-the-midnightbsd-package-manager-mport-before-2-7-8-used)
- [MidnightBSD mport directory traversal in package installation](https://junglewise.ai/threats/cve-2026-54587-midnightbsd-mport-directory-traversal-in-package-installation)
- [MidnightBSD mport HTTP package fetch without HTTPS enforcement](https://junglewise.ai/threats/cve-2026-54586-midnightbsd-mport-http-package-fetch-without-https-enforcement)
- [MidnightBSD mport path traversal in sample-file handling](https://junglewise.ai/threats/cve-2026-54585-midnightbsd-mport-path-traversal-in-sample-file-handling)
- [MidnightBSD mport path traversal in bundle filename handling](https://junglewise.ai/threats/cve-2026-54583-midnightbsd-mport-path-traversal-in-bundle-filename-handling)