CVE-2026-54587

Katalog CVE

CVSS 5.8 · Medium EPSS 0,11%

Kerentanan Improper Link Resolution Before File Access ('Link Following'). Skor CVSS 4.0 5.8 (Medium) menurut github.com.

Deskripsi (NVD)

mport is the MidnightBSD Package Manager. Prior to 2.7.8, directory assets handled as ASSET_DIR or ASSET_DIR_OWNER_MODE in libmport/bundle_read_install_pkg.c used path-based mport_mkdirp(), ownership, and permission operations. A local attacker able to modify part of the target installation tree could use dot-dot traversal or substitute symlinks during privileged package installation, causing directory creation or attribute changes to affect attacker-selected paths outside the intended package directories. This issue is fixed in version 2.7.8.

Rincian

Terbit di NVD

17 September 2026

Terakhir diubah

17 September 2026

Status NVD

Deferred

CVSS 4.0

5.8 (Medium), sumber github.com
CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-59: Improper Link Resolution Before File Access ('Link Following')
CWE-367: Time-of-check Time-of-use (TOCTOU) Race Condition

EPSS (30 hari)

0,11% peluang dieksploitasi; lebih tinggi dari 0,9% CVE lain

Produk dan versi terdampak

NVD belum mencantumkan data produk (CPE) untuk CVE ini. Produk yang terdampak biasanya disebut di deskripsi dan di advisory vendor pada daftar referensi.

Referensi dan perbaikan

• https://github.com/MidnightBSD/mport/commit/a4fa996df1fbebeff3691e1b512c807b5f414b5d
• https://github.com/MidnightBSD/mport/pull/119
• https://github.com/MidnightBSD/mport/releases/tag/2.7.8
• https://github.com/MidnightBSD/mport/security/advisories/GHSA-f69w-h3gh-r86p