# CVE-2026-54584: mport insecure TMPDIR usage in privileged contexts

Source: https://junglewise.ai/threats/cve-2026-54584-mport-is-the-midnightbsd-package-manager-mport-before-2-7-8-used  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-21. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-54584 · Severity: info · Published 2026-09-21

mport is the package manager for MidnightBSD systems. Versions before 2.7.8 unsafely used the TMPDIR environment variable when extracting package metadata, even when running with elevated privileges (as root or in setuid/setgid contexts). An attacker who controls the environment could redirect temporary file operations to a location under their control, potentially enabling privilege escalation or code execution when a privileged user installs a package.

Technologies: [MidnightBSD Mport](https://junglewise.ai/threats/technologies/mport). Vendors: [MidnightBSD](https://junglewise.ai/threats/vendors/midnightbsd).

## Quick answers

**Is CVE-2026-54584 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-54584 being exploited in the wild.

**How severe is CVE-2026-54584?** Informational severity, published 21 September 2026.

**Which products and versions are affected?** MidnightBSD Mport before 2.7.8.

**Is there a fix for CVE-2026-54584?** A patch was published on 2026-05-14: Fixed in version 2.7.8 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-54584 attacked?** It is attacked with local access, in an operating system.

**Am I affected by CVE-2026-54584?** Check whether you run MidnightBSD Mport at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability exists in libmport's bundle_read_extract_metafiles() function, which respected the TMPDIR environment variable during package metadata extraction without validating whether it was safe to do so in privileged contexts. An attacker with environment control could set TMPDIR to a world-writable or attacker-controlled directory, exploiting the temporary file handling during package installation by root or setuid processes. Version 2.7.8 fixes this by using issetugid() and geteuid() checks to reject unsafe TMPDIR values in privileged execution contexts and reject empty TMPDIR strings.

## Affected products

- MidnightBSD mport before 2.7.8

## Timeline

- 2026-05-14: patched: Fixed in version 2.7.8
- 2026-09-21: disclosed

## References

- [https://github.com/MidnightBSD/mport/commit/3790fa49a36cb085f48b204ef189fb82bbee621a](https://github.com/MidnightBSD/mport/commit/3790fa49a36cb085f48b204ef189fb82bbee621a)
- [https://github.com/MidnightBSD/mport/pull/123](https://github.com/MidnightBSD/mport/pull/123)

## Related threats

- [MidnightBSD mport directory traversal in package installation](https://junglewise.ai/threats/cve-2026-54587-midnightbsd-mport-directory-traversal-in-package-installation)
- [MidnightBSD mport HTTP package fetch without HTTPS enforcement](https://junglewise.ai/threats/cve-2026-54586-midnightbsd-mport-http-package-fetch-without-https-enforcement)
- [MidnightBSD mport path traversal in sample-file handling](https://junglewise.ai/threats/cve-2026-54585-midnightbsd-mport-path-traversal-in-sample-file-handling)
- [MidnightBSD mport path traversal in bundle filename handling](https://junglewise.ai/threats/cve-2026-54583-midnightbsd-mport-path-traversal-in-bundle-filename-handling)
- [MidnightBSD mport file conflict check bypass](https://junglewise.ai/threats/cve-2026-54582-midnightbsd-mport-file-conflict-check-bypass)