CVE-2026-54575
- Source
- https://cve.org/CVERecord?id=CVE-2026-54575
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-54575.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2026-54575
- Aliases
-
- GHSA-h387-g4pf-28cj
- Published
- 2026-09-17T16:55:19Z
- Modified
- 2026-09-23T08:12:40Z
- Severity
-
- 5.8 (Medium) CVSS_V4 - CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N CVSS Calculator
- Summary
- mport package fetch and clean paths are vulnerable to TOCTOU filesystem races
- Details
-
mport is the MidnightBSD Package Manager. Prior to 2.7.8, privileged package fetch and cache-cleaning operations used race-prone path handling across libmport/fetch.c, libmport/clean.c, libmport/util.c, libmport/bundle_read_install_pkg.c, libmport/delete_primative.c, and libexec/mport.create/mport.create.c. A local attacker with write access to a participating package cache or staging path could race path checks and replacement operations to redirect package downloads, cleanup, or install-related side effects outside the intended cache. The affected lifecycle helper paths also used shell-form invocation, increasing command-line interpretation risk during privileged helper execution. This issue is fixed in version 2.7.8.
- Database specific
{ "cna_assigner": "GitHub_M", "cwe_ids": [ "CWE-367", "CWE-78" ], "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/54xxx/CVE-2026-54575.json" }- References
-
- https://github.com/MidnightBSD/mport/releases/tag/2.7.8
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/54xxx/CVE-2026-54575.json
- https://github.com/MidnightBSD/mport/security/advisories/GHSA-h387-g4pf-28cj
- https://nvd.nist.gov/vuln/detail/CVE-2026-54575
- https://github.com/MidnightBSD/mport/commit/29154b0fdfb5806568ed1277e88d942bad6d1169
- https://github.com/MidnightBSD/mport/pull/118
Affected packages
Git / github.com/midnightbsd/mport
Affected versions
2.*
2.0
2.0.1
2.0.2
2.0.5
2.0.6
2.0.7
2.0.8
2.0.9
2.1.0
2.1.1
2.1.2
2.1.3
2.1.4
2.1.5
2.1.6
2.1.7
2.1.8
2.1.9
2.2.0
2.2.1
2.2.2
2.2.3
2.2.4
2.2.5
2.2.6
2.2.7
2.2.8
2.2.9
2.2.9.1
2.3.0
2.4.0
2.4.1
2.4.3
2.4.4
2.4.5
2.4.6
2.4.7
2.4.8
2.5.0
2.5.1
2.6.0
2.6.1
2.6.2
2.6.3
2.6.4
2.6.5
2.6.7
2.6.8
2.7.0
2.7.1
2.7.2
2.7.3
2.7.4
2.7.5
2.7.6
Database specific
source
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-54575.json"
vanir_signatures
[
{
"deprecated": false,
"digest": {
"function_hash": "137147513844556653286257173365204246305",
"length": 3111
},
"id": "CVE-2026-54575-07c0b4f3",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/midnightbsd/mport/commit/29154b0fdfb5806568ed1277e88d942bad6d1169",
"target": {
"file": "libmport/bundle_read_install_pkg.c",
"function": "run_postexec"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"11475394956103522402116063072573479198",
"82518725333171253607684251606111865292",
"194057341659971384192826542681178757911",
"283609510767792579895051993485750004175",
"266495938401102147718363258000098303341",
"317180760618573174452889184536947063404",
"230135801159721268404622794599816406040",
"50389821107726732622176736042534794498"
],
"threshold": 0.9
},
"id": "CVE-2026-54575-0f14b3f2",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/midnightbsd/mport/commit/29154b0fdfb5806568ed1277e88d942bad6d1169",
"target": {
"file": "libmport/util.c"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "284734007778760443162667545468136739063",
"length": 1468
},
"id": "CVE-2026-54575-14323c05",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/midnightbsd/mport/commit/29154b0fdfb5806568ed1277e88d942bad6d1169",
"target": {
"file": "libmport/clean.c",
"function": "mport_clean_oldpackages"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"325563250280491047769144344096977359668",
"236161134873429206371803749555872893196",
"208889543989266265367884391559527029486",
"133283934139292109385832220192907328594",
"155872470121518015594218715094056913254",
"269378485072915356215320276668735052464",
"5316932000849359108626175380815596285",
"16031932911180592321887445657166123324",
"208175863603321890253074347466169904645",
"206982278777018453453222984517186234722",
"169273049038674411470588711753266213081",
"67215574788174529810781006755920579612",
"285126239035342642279759887525895226608",
"287458674147009568199892472927644587339",
"218895761384147179033818677526315398061",
"302244057174011214793448553407445810979",
"186056039197841567056151062912337777036",
"328333636949795718123690384976955274837",
"19233288683258423059592547988330508052",
"83269392866936518191520299547753012365",
"76615553519474527846297032622078948708",
"224604867986062375022227112618870187232",
"140136508266464455310954479065266416155",
"146616373002724380220903730379866318042",
"1557194798454374935090740188873939523",
"77801013656563352805679587737952706312",
"83269392866936518191520299547753012365",
"166411911589509259360096167264651858430",
"184071668103401961435056377995944536711",
"56483609886518940103909260521161746370",
"120926031864092392324105001723735694727",
"289205194212227524585427926479218402659",
"5572809954774288349903461534763570201",
"17329278601590705379445668921319801039",
"182013381953606000354412515067013954271",
"49450908690704678759810942503798398307",
"105812431824231571071044908441026261779",
"60081857684541333386960372325364929482"
],
"threshold": 0.9
},
"id": "CVE-2026-54575-1b59b03c",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/midnightbsd/mport/commit/29154b0fdfb5806568ed1277e88d942bad6d1169",
"target": {
"file": "libmport/clean.c"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "79616791461066690541790871307003249497",
"length": 1357
},
"id": "CVE-2026-54575-2066a907",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/midnightbsd/mport/commit/29154b0fdfb5806568ed1277e88d942bad6d1169",
"target": {
"file": "libmport/fetch.c",
"function": "mport_fetch_bundle"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "292232835223173317997676878790821823561",
"length": 589
},
"id": "CVE-2026-54575-33f92310",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/midnightbsd/mport/commit/29154b0fdfb5806568ed1277e88d942bad6d1169",
"target": {
"file": "libmport/fetch.c",
"function": "mport_fetch_cves"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"283163510412534374420012661433197507863",
"35648646127066072481245412860481828700",
"75393662308506708193823591903378044687",
"110399029476620483993731882787875713283",
"249629689439193113038331323696003095775",
"63000575414284801773203645570643786369",
"5013729878558058226327469261623901997",
"200463280322146119628044556303489564499",
"308275869405597491506237188213191633172",
"219429411368227880001850668368369041553",
"179537493954563637482149109356288072937",
"215724110006590291181974107952814272321",
"132838055168236112835315797800664218794",
"150359928581453132013938972713599093126",
"154920866838150818642117239901086002883",
"198927089155622263521776161654447146633",
"165189412624629748569914101415828094787"
],
"threshold": 0.9
},
"id": "CVE-2026-54575-48f2a2fc",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/midnightbsd/mport/commit/29154b0fdfb5806568ed1277e88d942bad6d1169",
"target": {
"file": "libexec/mport.create/mport.create.c"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "196537778812890803607086079752017476332",
"length": 370
},
"id": "CVE-2026-54575-49cee073",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/midnightbsd/mport/commit/29154b0fdfb5806568ed1277e88d942bad6d1169",
"target": {
"file": "libmport/fetch.c",
"function": "fetch"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "127932989124905786489690233828707457862",
"length": 1534
},
"id": "CVE-2026-54575-4f2949b1",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/midnightbsd/mport/commit/29154b0fdfb5806568ed1277e88d942bad6d1169",
"target": {
"file": "libmport/fetch.c",
"function": "fetch_to_file"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"299265668396515864454367249725043152686",
"104911725553081760902941758742288349350",
"280027914466497646518379172550041198945",
"235179357180816855828103148401969473601",
"61151361812142113535869483713320378404",
"119285109845885236512443640274217671804",
"38908226630373385094202273864559867346",
"161633134915310969975383656424609297543",
"158479975931778206198242654295898960720",
"15387072054669734644261243247886106123",
"133892459072083499930332743822107016475",
"44469295458219203573512937657392086068",
"270387958602248974094766528082243728362",
"49047591699216750517399219286143653783",
"222871352220422123569664914456699094396",
"178377636822841131569424730731554495325",
"300162368750500673994145667367937493920",
"224890912158991780052360343661012413197",
"208557140938536677546327371311918288273",
"110207590087645891989583272510794511675",
"320536240200403751378916945796635535801",
"15660436912926760241270486585905213539",
"25152035473082630452507411338228358626",
"25555597970778016476123181507681966191",
"331447711862903761098944402402174449036",
"128968035690692146926491421415334097094",
"292185601818289251625488408306324890572",
"109017486733079749635017546041894452219",
"30243772262386043236747070056175620100",
"5252929099948960213346721281378380751",
"266857221552513330724286858449856931067",
"183923230424222138948238706712402935947",
"193716665306928967768597322465195606293",
"55289425536363799072413991210025813798",
"21867423908327619960332554234031936832",
"170166021785567918765634924539906128853",
"51325238770242704341886859060058651563",
"118885306099877669603092065799976741634",
"35344385144277850233283314259012488384",
"222928403297795584114446574583433505965",
"172741545749707074439655177173521524842",
"185568572071453513164386392304895247034",
"106824913099355809270070344467882842019",
"18649511088243584395082365379134971534",
"25266512708181128324763740626888696411",
"79389990024587830556655455156109043469",
"145550600636286575767527251256526029229",
"263499342341460684541623801364163621807",
"283382406643442269739922951707850995120",
"319059499567953399278231240694866461812",
"24946436942547336012036395274187657654",
"308654825009756580001432165045742613837",
"207508426613554225326509635570136741338",
"201339814106422755555918966258393449132",
"200502316999305849332428106953389931369",
"320099820143326854002759360986928774487",
"306375597330542481364944346898121528755",
"99660230946440346439155050003271657315",
"59283955883958399648471016201651287573",
"28099082558114222584750332947550501599",
"226670967935846732931369131003204082156",
"29561794097234387146930990116983621318",
"309968931805795150451250191771116160698",
"276297246033792164815656242451967493569",
"127285583876751085673339939147613618988",
"273088098643832568111941502398164935052",
"336757296528162151826480092218670571831",
"165722182767484665884694916874293756558",
"79284300392053841821453534022558304916",
"178289021412197807538182237668714932060",
"29242375430240441596901912490207745527",
"187136315953138502438148460565340683213",
"330350707885559431412372520612064704834",
"59664477377884150951733527836187552291",
"137291109937012765801844844263973762029",
"19786714923097366832027260941166116265"
],
"threshold": 0.9
},
"id": "CVE-2026-54575-5427b296",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/midnightbsd/mport/commit/29154b0fdfb5806568ed1277e88d942bad6d1169",
"target": {
"file": "libmport/fetch.c"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "255154916321466067701208374074883332561",
"length": 1124
},
"id": "CVE-2026-54575-63c3d016",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/midnightbsd/mport/commit/29154b0fdfb5806568ed1277e88d942bad6d1169",
"target": {
"file": "libexec/mport.create/mport.create.c",
"function": "usage"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "140449510668304095223619144515714315799",
"length": 3688
},
"id": "CVE-2026-54575-6e778842",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/midnightbsd/mport/commit/29154b0fdfb5806568ed1277e88d942bad6d1169",
"target": {
"file": "libexec/mport.create/mport.create.c",
"function": "main"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"315871945396811033882106706528904341139",
"205072407764402070792446707234005548299",
"206626859862931916135182419958591865018",
"264874043679692597708643195244548876458",
"159757427149591394962685756713355691075",
"34282681640189605757810493788579331347",
"131247833711789289984934102551513001980",
"160349090466886823340636468078120838318",
"75953499778805722264665640652630063523",
"121898190934624501302172536700515282400",
"130154592146357048406494702012417030709",
"163718054988051457206948734703463032109",
"260253245832933644495325604882506999827",
"163390330017406173868514175977017836495",
"273044645211350846033584871890401335473",
"309209375248919462498417159410910230655",
"247037980998505698851123749836255952119",
"339977268086062062120101577866071771353",
"101282644783396893025610523010848890024",
"102142055529247352087754297073815348127",
"108388609124094819780446096110356726475",
"199250082746588882805361828876988717473",
"335935009146687890933626436166666971459",
"224922688278539261119178632271043749678",
"126792832584683983998453181475877307648",
"261038500821720978244429922342321379256",
"26824036105809985504123091065295559541",
"146667452104293499227430772865084324455",
"15396053916742764011660027475232235628",
"335716214532776434024165671018420388192",
"73659192437725043366486812073069345346",
"55960890775256301089032401534606167185",
"242805029190307479051832610418713282092",
"38032096832667471142657634685172499211",
"333136714132823465634104844688513257601",
"26577712574517579139944740395378343980",
"85778428466720498262386640238016461920",
"175405982758443868094558927547505572855",
"287011073948031623649090486818131546953",
"219272339409928623466946340700757741855",
"127752626037007765089023398361115127130",
"133981743377066797332834499337476608397",
"321438274118850358655622567125906085271",
"162214969112094234104600028668700391636",
"5152919645880706445138477326421160042",
"129903977592359420088369322853761712541",
"255574919383758148512638091526341169144"
],
"threshold": 0.9
},
"id": "CVE-2026-54575-8483823d",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/midnightbsd/mport/commit/29154b0fdfb5806568ed1277e88d942bad6d1169",
"target": {
"file": "libmport/delete_primative.c"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "306371832968666090312630438466972756373",
"length": 1388
},
"id": "CVE-2026-54575-88faab68",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/midnightbsd/mport/commit/29154b0fdfb5806568ed1277e88d942bad6d1169",
"target": {
"file": "libmport/delete_primative.c",
"function": "run_unldconfig"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"36009377738662038206778955267665086931",
"233234506501756335644211890708711651427",
"251727539547009848022010424149121420972",
"20631198764540432707060667750792861825",
"323467244543209055678315655484099312459",
"200057989913668198480386071671041843462",
"169432206632994185758795744833166096498",
"279910223460901576245618569992303209059",
"116852150482093079532409496689308786787",
"11403454858384607525695189268163563813",
"242358838455269554516980887876632863347",
"56045068332679442305967246698467234346",
"26577712574517579139944740395378343980",
"181381898631054431832052555124023913845",
"113916168192479078332792977730687666844",
"66451428298605833654807593106594746964",
"48915499303145983397864696508754486245",
"127752626037007765089023398361115127130",
"262893196626514595503726839461490510461",
"299490719088564627083545520104421706885",
"291735287502645414074315869414750168322",
"130181859504663765638912979360894020710"
],
"threshold": 0.9
},
"id": "CVE-2026-54575-9512bf70",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/midnightbsd/mport/commit/29154b0fdfb5806568ed1277e88d942bad6d1169",
"target": {
"file": "libmport/bundle_read_install_pkg.c"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"302956968718453474809507540325127881458",
"194639926327913618753942248538500004577",
"33050952978603889608833165093248204495",
"140706362150222479376613479133694014013"
],
"threshold": 0.9
},
"id": "CVE-2026-54575-b7e978c9",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/midnightbsd/mport/commit/29154b0fdfb5806568ed1277e88d942bad6d1169",
"target": {
"file": "libmport/mport_private.h"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "191027468455084880700878892091254332962",
"length": 2213
},
"id": "CVE-2026-54575-c31388ba",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/midnightbsd/mport/commit/29154b0fdfb5806568ed1277e88d942bad6d1169",
"target": {
"file": "libmport/delete_primative.c",
"function": "run_special_unexec"
}
}
]
vanir_signatures_modified
"2026-09-23T08:12:40Z"