EUVD-2026-83920Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attacker must control a local privileged process's environment and win an extraction race (AV:L, AC:H, PR:L); impact is filesystem path redirection (integrity I:L), not disclosure.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
2DescriptionCVE.org
mport is the MidnightBSD Package Manager. mport before 2.7.8 used TMPDIR while extracting package metafiles, including when running as root or in setuid/setgid contexts. An attacker able to control the environment for a privileged mport invocation could redirect temporary metadata extraction to an attacker-controlled location. PR 123 ignores unsafe TMPDIR values in privileged contexts and rejects empty TMPDIR. This issue has been patched in version 2.7.8.
AnalysisAI
MidnightBSD's mport package manager before 2.7.8 trusts the TMPDIR environment variable when extracting package metafiles, so an attacker who can influence the environment of a privileged (root or setuid/setgid) mport invocation can redirect temporary metadata extraction into a location they control. Exploitation requires a local foothold on a MidnightBSD host, a privileged mport run that inherits the attacker-supplied environment, and success in the extraction timing window, which keeps this a low-to-moderate-risk local path-integrity issue rather than a remotely exploitable flaw; no public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires an attacker with LOCAL presence on a MidnightBSD system who can control the environment (specifically the TMPDIR variable) of an mport invocation that runs as root or in a setuid/setgid context - i.e., the privileged package operation must inherit the attacker-influenced environment. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a genuinely low-to-moderate-risk local privilege/path-integrity issue, not a high-priority remotely exploitable flaw. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Vendor-released patch: upgrade mport to version 2.7.8 (release tag https://github.com/MidnightBSD/mport/releases/tag/2.7.8), which contains the fix from PR 123 (commit 3790fa49a36cb085f48b204ef189fb82bbee621a) that ignores TMPDIR whenever issetugid() is true or the effective UID is 0 and also rejects empty TMPDIR values; see advisory https://github.com/MidnightBSD/mport/security/advisories/GHSA-4vv3-3h8r-q6mq. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Midnightbsd
View allA memory corruption vulnerability was found in the kernel function kern_getfsstat in MidnightBSD before 1.2.7 and 1.3 th
Package-index corruption and denial of package-management operations affect MidnightBSD mport before 2.7.8 when a malici
Path traversal in the MidnightBSD mport package manager (libmport/fetch.c) before version 2.7.8 lets an attacker who con
MidnightBSD's mport package manager prior to 2.7.8 can accept a tampered bootstrap package index as verified, because th
On-path tampering with package-fetch traffic in MidnightBSD's mport package manager lets a network-positioned attacker s
Path traversal in MidnightBSD mport before 2.7.8 allows a crafted package manifest to make the privileged sample-file ha
Package file overwrite in MidnightBSD mport prior to 2.7.8 allows a crafted package installed with privileges to replace
Filesystem integrity compromise in MidnightBSD's mport package manager (versions prior to 2.7.8): a local user who alrea
Symlink following and dot-dot path traversal in MidnightBSD mport prior to 2.7.8 lets a local attacker who can already w
Path-racing and shell-invocation weaknesses in the MidnightBSD mport package manager (all versions prior to 2.7.8) let a
In MidnightBSD before 1.2.6 and 1.3 before August 2020, and FreeBSD before 7, a NULL pointer dereference was found in th
Spoofed or injected ICMP echo replies can steer mport's mirror-latency selection toward an attacker-chosen mirror and, i
Same weakness CWE-73 – External Control of File Name or Path
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today