Is CVE-2026-54587 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-54587 being exploited in the wild.

How severe is CVE-2026-54587?

Informational severity, published 17 September 2026.

Which products and versions are affected?

MidnightBSD Mport prior to 2.7.8.

Is there a fix for CVE-2026-54587?

A patch was published on 2026-04-23: Fixed in version 2.7.8 via commit a4fa996 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-54587 attacked?

It is attacked with local access, in an operating system.

Am I affected by CVE-2026-54587?

Check whether you run MidnightBSD Mport at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-54587: MidnightBSD mport directory traversal in package installation

CVE-2026-54587 · Severity: info · Published 2026-09-17

mport is the package manager for MidnightBSD systems. Prior to version 2.7.8, a local attacker could exploit directory handling during privileged package installation to create directories or modify permissions on arbitrary paths outside the intended package directories using symlink substitution or path traversal techniques. This could allow unauthorized modification of system files or directories during package operations.

Technologies: MidnightBSD Mport. Vendors: MidnightBSD.

Quick answers

Is CVE-2026-54587 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-54587 being exploited in the wild.
How severe is CVE-2026-54587?: Informational severity, published 17 September 2026.
Which products and versions are affected?: MidnightBSD Mport prior to 2.7.8.
Is there a fix for CVE-2026-54587?: A patch was published on 2026-04-23: Fixed in version 2.7.8 via commit a4fa996 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-54587 attacked?: It is attacked with local access, in an operating system.
Am I affected by CVE-2026-54587?: Check whether you run MidnightBSD Mport at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability exists in libmport/bundle_read_install_pkg.c where directory assets marked as ASSET_DIR or ASSET_DIR_OWNER_MODE were processed using path-based operations without proper validation. The vulnerable code used mport_mkdirp(), ownership, and permission operations on user-supplied paths without sanitizing ".." traversal components or validating symlink targets. A local attacker with write access to parts of the target installation tree could exploit race conditions or substitute symlinks to cause directory creation or attribute modifications affecting attacker-selected paths. The fix (version 2.7.8) hardens the code by using openat()-based relative path operations anchored to the install root, rejecting ".." components, and using O_NOFOLLOW to prevent symlink attacks.

Affected products

MidnightBSD mport prior to 2.7.8

Timeline

2026-09-17: disclosed
2026-04-23: patched: Fixed in version 2.7.8 via commit a4fa996

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.