Executive brief
mport is the package manager for MidnightBSD, a free operating system. Versions before 2.7.8 failed to properly validate bundle filenames from package indexes, allowing malicious package metadata to write downloaded packages outside their intended cache directory. This could enable attackers to overwrite arbitrary files on systems using mport to install packages.
Technical details
The vulnerability is a path traversal flaw in libmport/fetch.c where the is_valid_bundle_filename() validation was not consistently applied before using package bundle filenames from index data. An attacker controlling or poisoning a package index could inject malicious values (empty strings, dot, dot-dot, or paths containing slashes) into the bundlefile field, causing mport to write downloaded packages to arbitrary filesystem locations. This requires the package index to be compromised or the user to be directed to a malicious index. The fix, deployed in version 2.7.8, adds proper filename validation before download and file write operations.
Affected products
- MidnightBSD mport before 2.7.8
Timeline
- 2026-09-17: disclosed
- 2026-05-15: patched: Fix merged in pull request #125