CVSS 4.0
5.8 mediumCVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:NCVE-2026-54587
Medium (5.8). EPSS 0.1% chance of exploitation in the next 30 days.
mport is the MidnightBSD Package Manager. Prior to 2.7.8, directory assets handled as ASSET_DIR or ASSET_DIR_OWNER_MODE in libmport/bundle_read_install_pkg.c used path-based mport_mkdirp(), ownership, and permission operations. A local attacker able to modify part of the target installation tree could use dot-dot traversal or substitute symlinks during privileged package installation, causing directory creation or attribute changes to affect attacker-selected paths outside the intended package directories. This issue is fixed in version 2.7.8.
Severity
- EPSS
- 0.1% chance of exploitation in the next 30 days; higher than 1% of CVEs (scores of 2026-10-31)
- CWEs
- CWE-59, CWE-367
- Published
- Modified
- Record from
- the NVD, synced