CVE-2026-54583 mport package bundle downloads allow unsafe destination filenames
Attackers can write package data to arbitrary locations via malicious index data due to missing filename validation in MidnightBSD's mport.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-54583?
CVE-2026-54583 is a high-severity path traversal vulnerability in MidnightBSD mport, published on 17 Sep 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
mport is the MidnightBSD Package Manager. Prior to 2.7.8, libmport/fetch.c did not consistently reject empty, dot, dot-dot, or slash-containing bundle filenames before composing package download and write paths. Malicious package index data could place an unsafe value in indexEntry->bundlefile, and the missing is_valid_bundle_filename() checks allowed downloaded package data to be written outside the intended cache location or to an unsafe destination name. This issue is fixed in version 2.7.8.
Which versions are affected by CVE-2026-54583?
How do I fix CVE-2026-54583?
No fix has been published for CVE-2026-54583 yet. Limit exposure of the affected software until one is available.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2026-54583 being exploited?
There is no known exploitation of CVE-2026-54583 in the wild and no public exploit code.
Sources
Also known as GHSA-mr62-mqwj-vhh3.