CVE-2026-54582

UNKNOWN 0.0

mport package installation can overwrite existing unmanaged or differently owned files

CVSS Score

0.0

EPSS Score

0.0%

EPSS Percentile

0th

mport is the MidnightBSD Package Manager. Prior to 2.7.8, package installation lacked a preflight check for incoming non-directory assets that already existed on disk. The affected logic across libmport/check_preconditions.c, libmport/install_primative.c, and libmport/mport_private.h did not apply MPORT_PRECHECK_FILE_CONFLICTS, so a crafted or conflicting package could overwrite a file owned by another package or unmanaged by mport. The check is bypassed only when the operator explicitly enables mport->force. Privileged installation without that override could compromise local filesystem integrity and package database consistency. This issue is fixed in version 2.7.8.

CWE	CWE-73 CWE-668
Vendor	midnightbsd
Product	mport
Published	Sep 17, 2026

Stay Ahead of the Next One

Get instant alerts for midnightbsd mport

Be the first to know when new unknown vulnerabilities affecting midnightbsd mport are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

Affected Versions

MidnightBSD / mport

< 2.7.8

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/MidnightBSD/mport/security/advisories/GHSA-5773-7r4r-rpgx github.com: https://github.com/MidnightBSD/mport/pull/131 github.com: https://github.com/MidnightBSD/mport/commit/c643312d149dcc994957dbafa8f6f6b61e945e39 github.com: https://github.com/MidnightBSD/mport/releases/tag/2.7.8