# CVE-2026-54585: MidnightBSD mport path traversal in sample-file handling

Source: https://junglewise.ai/threats/cve-2026-54585-midnightbsd-mport-path-traversal-in-sample-file-handling  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-17. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-54585 · Severity: info · Published 2026-09-17

mport is the package manager for MidnightBSD, a FreeBSD-derived operating system. A flaw in how it processes package manifests could allow a malicious or malformed package to write files outside the intended installation directory, potentially compromising system integrity and enabling unauthorized file modification or system takeover when packages are installed with elevated privileges.

Technologies: [MidnightBSD Mport](https://junglewise.ai/threats/technologies/mport). Vendors: [MidnightBSD](https://junglewise.ai/threats/vendors/midnightbsd).

## Quick answers

**Is CVE-2026-54585 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-54585 being exploited in the wild.

**How severe is CVE-2026-54585?** Informational severity, published 17 September 2026.

**Which products and versions are affected?** MidnightBSD Mport prior to 2.7.8.

**Is there a fix for CVE-2026-54585?** A patch was published on 2026-05-14: Fixed in version 2.7.8 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-54585 attacked?** It is attacked over the network or with local access, in a software library.

**Am I affected by CVE-2026-54585?** Check whether you run MidnightBSD Mport at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A path traversal vulnerability exists in the create_sample_file() function in libmport/bundle_read_install_pkg.c prior to version 2.7.8. The function fails to properly constrain absolute source and destination paths specified in the sample-file manifest directive to the configured mport installation root, allowing an attacker-controlled package manifest to direct file operations outside the intended root directory. An attacker can craft a malicious package containing sample-file directives with absolute paths that, when processed by privileged mport operations, write arbitrary files to the filesystem. The vulnerability requires a user to install or process a malicious package, but would be exploited with package manager privileges. The issue is fixed in version 2.7.8.

## Affected products

- MidnightBSD mport prior to 2.7.8

## Timeline

- 2026-09-17: disclosed
- 2026-05-14: patched: Fixed in version 2.7.8

## References

- [https://github.com/MidnightBSD/mport/commit/36a42c8ddbd23ee9eb72c4c17596eb92cb423cf0](https://github.com/MidnightBSD/mport/commit/36a42c8ddbd23ee9eb72c4c17596eb92cb423cf0)
- [https://github.com/MidnightBSD/mport/pull/122](https://github.com/MidnightBSD/mport/pull/122)

## Related threats

- [mport insecure TMPDIR usage in privileged contexts](https://junglewise.ai/threats/cve-2026-54584-mport-is-the-midnightbsd-package-manager-mport-before-2-7-8-used)
- [MidnightBSD mport directory traversal in package installation](https://junglewise.ai/threats/cve-2026-54587-midnightbsd-mport-directory-traversal-in-package-installation)
- [MidnightBSD mport HTTP package fetch without HTTPS enforcement](https://junglewise.ai/threats/cve-2026-54586-midnightbsd-mport-http-package-fetch-without-https-enforcement)
- [MidnightBSD mport path traversal in bundle filename handling](https://junglewise.ai/threats/cve-2026-54583-midnightbsd-mport-path-traversal-in-bundle-filename-handling)
- [MidnightBSD mport file conflict check bypass](https://junglewise.ai/threats/cve-2026-54582-midnightbsd-mport-file-conflict-check-bypass)