EUVD-2026-82319Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-delivered via package fetch (AV:N) but requires attacker-controlled/poisoned index, mapped to AC:H in 3.1; no auth (PR:N); arbitrary file write gives I:H with limited A:L and no C.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
4DescriptionCVE.org
mport is the MidnightBSD Package Manager. Prior to 2.7.8, libmport/fetch.c did not consistently reject empty, dot, dot-dot, or slash-containing bundle filenames before composing package download and write paths. Malicious package index data could place an unsafe value in indexEntry->bundlefile, and the missing is_valid_bundle_filename() checks allowed downloaded package data to be written outside the intended cache location or to an unsafe destination name. This issue is fixed in version 2.7.8.
AnalysisAI
Path traversal in the MidnightBSD mport package manager (libmport/fetch.c) before version 2.7.8 lets an attacker who controls package index data smuggle an unsafe value into indexEntry->bundlefile so that downloaded package data is written outside the intended cache directory or to an attacker-chosen filename. Unauthenticated remote attackers can exploit this only if they can influence the index that mport consumes, for example through a malicious or compromised package mirror or a man-in-the-middle position on the download channel, and only when the victim subsequently runs mport to download or install a package; the independent assessment rates this as a conditionally-gated integrity flaw (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:L) rather than drive-by remote code execution, with no confidentiality impact and only limited availability impact. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the attacker to control the content of the package index that mport consumes - specifically the ability to set indexEntry->bundlefile (via a malicious or compromised package mirror/repository, or a man-in-the-middle position on the download channel). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a genuine but conditionally-gated integrity flaw, not a drive-by remote code execution bug. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade mport to version 2.7.8 or later (vendor-released patch: 2.7.8), available from the MidnightBSD mport 2.7.8 release page at https://github.com/MidnightBSD/mport/releases/tag/2.7.8; the fix is also visible in the advisory at https://github.com/MidnightBSD/mport/security/advisories/GHSA-mr62-mqwj-vhh3, pull request https://github.com/MidnightBSD/mport/pull/125 and commit https://github.com/MidnightBSD/mport/commit/cad959d47bc79a62b6a7163800fbfe35633e7cf8, so distributions that package mport should backport that commit if they cannot move to 2.7.8. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all MidnightBSD systems running mport, especially those configured to use third-party, non-HTTPS, or untrusted mirrors; restrict mport to approved, officially maintained mirrors over TLS with certificate validation; verify package index signatures or checksums where available; and temporarily require manual review before any mport download or install. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Midnightbsd
View allA memory corruption vulnerability was found in the kernel function kern_getfsstat in MidnightBSD before 1.2.7 and 1.3 th
Package-index corruption and denial of package-management operations affect MidnightBSD mport before 2.7.8 when a malici
MidnightBSD's mport package manager prior to 2.7.8 can accept a tampered bootstrap package index as verified, because th
On-path tampering with package-fetch traffic in MidnightBSD's mport package manager lets a network-positioned attacker s
Path traversal in MidnightBSD mport before 2.7.8 allows a crafted package manifest to make the privileged sample-file ha
Package file overwrite in MidnightBSD mport prior to 2.7.8 allows a crafted package installed with privileges to replace
Filesystem integrity compromise in MidnightBSD's mport package manager (versions prior to 2.7.8): a local user who alrea
Symlink following and dot-dot path traversal in MidnightBSD mport prior to 2.7.8 lets a local attacker who can already w
Path-racing and shell-invocation weaknesses in the MidnightBSD mport package manager (all versions prior to 2.7.8) let a
In MidnightBSD before 1.2.6 and 1.3 before August 2020, and FreeBSD before 7, a NULL pointer dereference was found in th
Spoofed or injected ICMP echo replies can steer mport's mirror-latency selection toward an attacker-chosen mirror and, i
Checksum verification in MidnightBSD's mport package manager before 2.7.8 can silently continue after a hashing failure,
Same weakness CWE-22 – Path Traversal
View allSame technique Path Traversal
View allShare
External POC / Exploit Code
Leaving vuln.today