Executive brief
mport is the package manager for MidnightBSD systems. Versions before 2.7.8 unsafely used the TMPDIR environment variable when extracting package metadata, even when running with elevated privileges (as root or in setuid/setgid contexts). An attacker who controls the environment could redirect temporary file operations to a location under their control, potentially enabling privilege escalation or code execution when a privileged user installs a package.
Technical details
The vulnerability exists in libmport's bundle_read_extract_metafiles() function, which respected the TMPDIR environment variable during package metadata extraction without validating whether it was safe to do so in privileged contexts. An attacker with environment control could set TMPDIR to a world-writable or attacker-controlled directory, exploiting the temporary file handling during package installation by root or setuid processes. Version 2.7.8 fixes this by using issetugid() and geteuid() checks to reject unsafe TMPDIR values in privileged execution contexts and reject empty TMPDIR strings.
Affected products
- MidnightBSD mport before 2.7.8
Timeline
- 2026-05-14: patched: Fixed in version 2.7.8
- 2026-09-21: disclosed