CVE-2026-54575— mport package fetch and clean paths are vulnerable to TOCTOU filesystem races
Quick assessment
Affected
MidnightBSD mport
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
mport 是 MidnightBSD 的包管理器。在 2.7.8 版本之前，具有特权的包获取和缓存清理操作在 、 、 、 、 以及 中使用了容易引发竞争条件的路径处理机制。本地攻击者若对相关的包缓存或暂存路径具有写入权限，就可能通过竞争路径检查与替换操作，将包的下载、清理或安装相关的副作用引导至预期缓存范围之外。受影响的生命周期辅助路径还采用了 shell 形式的调用方式，从而在特权辅助程序执行期间增加了命令行解释的风险。该问题已在 2.7.8 版本中修复。
Possible ATT&CK Techniques 3 AI
T1015 T1059 · Command and Scripting Interpreter T1190 · Exploit Public-Facing ApplicationAffected Version Matrix 1
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| MidnightBSD | mport | < 2.7.8 |
affected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-54575
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
mport package fetch and clean paths are vulnerable to TOCTOU filesystem races
Source: CVE Program / CVE List V5
Vulnerability Description
mport is the MidnightBSD Package Manager. Prior to 2.7.8, privileged package fetch and cache-cleaning operations used race-prone path handling across libmport/fetch.c, libmport/clean.c, libmport/util.c, libmport/bundle_read_install_pkg.c, libmport/delete_primative.c, and libexec/mport.create/mport.create.c. A local attacker with write access to a participating package cache or staging path could race path checks and replacement operations to redirect package downloads, cleanup, or install-related side effects outside the intended cache. The affected lifecycle helper paths also used shell-form invocation, increasing command-line interpretation risk during privileged helper execution. This issue is fixed in version 2.7.8.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
OS命令中使用的特殊元素转义处理不恰当(OS命令注入)
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| MidnightBSD | mport | < 2.7.8 | - |
|
II. Public POCs for CVE-2026-54575
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-54575
请登录查看更多情报信息。
Patches & Fixes for CVE-2026-54575 (1)
Vendor Advisories for CVE-2026-54575 (1)
Vendor Pages for CVE-2026-54575 (1)
-
🔗 Release mport 2.7.8 · MidnightBSD/mport · GitHub x_refsource_MISC
Same Patch Batch · MidnightBSD · 2026-09-17 · 12 CVEs total
| CVE-2026-54583 | 8.3 HIGH | mport package bundle downloads allow unsafe destination filenames |
| CVE-2026-54581 | 8.3 HIGH | mport bootstrap index fetch can continue after hash verification failure |
| CVE-2026-54580 | 8.3 HIGH | mport index decompression can leave partial or corrupt index data after zstd failures |
| CVE-2026-54582 | 6.0 MEDIUM | mport package installation can overwrite existing unmanaged or differently owned files |
| CVE-2026-54585 | 6.0 MEDIUM | mport sample file handling can write outside the configured root |
| CVE-2026-54586 | 6.0 MEDIUM | mport permits repository and package mirror fetches over insecure transport |
| CVE-2026-54587 | 5.8 MEDIUM | mport directory asset installation is vulnerable to symlink and path traversal races |
| CVE-2026-54576 | 5.8 MEDIUM | mport package installation has symlink TOCTOU in chown and chmod handling |
| CVE-2026-54579 | 2.3 LOW | mport mirror-selection ping accepts insufficiently validated ICMP replies |
| CVE-2026-54577 | 2.0 LOW | mport audit can inspect the wrong package when options are present |
| CVE-2026-54578 | 2.0 LOW | mport verify can compare stale checksum data after hashing failures |
IV. Related Vulnerabilities
Same product: mport
-
CVE-2026-54579
mport mirror-selection ping accepts insufficiently validated -
CVE-2026-54576
mport package installation has symlink TOCTOU in chown and c -
CVE-2026-54587
mport directory asset installation is vulnerable to symlink -
CVE-2026-54578
mport verify can compare stale checksum data after hashing f -
CVE-2026-54586
mport permits repository and package mirror fetches over ins
Same vendor: MidnightBSD
-
CVE-2026-54579
mport mirror-selection ping accepts insufficiently validated -
CVE-2026-54576
mport package installation has symlink TOCTOU in chown and c -
CVE-2026-54587
mport directory asset installation is vulnerable to symlink -
CVE-2026-54578
mport verify can compare stale checksum data after hashing f -
CVE-2026-54586
mport permits repository and package mirror fetches over ins
Same weakness: CWE-78
-
CVE-2026-53534
JabRef CAYW Sublime Text integration permits operating-syste -
CVE-2026-92993
Dromara mayfly-go Machine Script Feature machine_script.go R -
CVE-2026-71538
@cyclonedx/cyclonedx-npm: Shell Injection via Unsanitized -- -
CVE-2026-90822
FatPipe 10.1.2r60p100 命令注入漏洞 -
CVE-2026-81476
Dell OMSA <11.1.0.3 OS命令注入漏洞
V. Comments for CVE-2026-54575
No comments yet