Executive brief
mport is the package manager for MidnightBSD, used to install and manage software packages. Versions prior to 2.7.8 lack a safety check that prevents package installation from overwriting files that already exist on disk, potentially corrupting the system or other packages. An attacker with the ability to install packages using the force flag could overwrite critical files and break package database consistency.
Technical details
The vulnerability is a missing input validation check in the package installation logic. Prior to version 2.7.8, the MPORT_PRECHECK_FILE_CONFLICTS precondition check was not applied across libmport/check_preconditions.c, libmport/install_primative.c, and libmport/mport_private.h, allowing incoming packages to overwrite existing files without detection. The check is bypassed only when the mport->force flag is explicitly enabled; normal privileged installation without this override is protected. An attacker with local access and ability to explicitly force package installation could craft a malicious or conflicting package to overwrite files owned by other packages or untracked by mport, compromising filesystem and package database integrity. This issue is fixed in version 2.7.8 by adding proper file conflict detection before installation.
Affected products
- MidnightBSD mport prior to 2.7.8
Timeline
- 2026-05-14: patched: Fix merged in commit c643312d149dcc994957dbafa8f6f6b61e945e39
- 2026-09-17: disclosed