Filesystem Vulnerability in MidnightBSD Package Manager by MidnightBSD

CVE-2026-54582

What is CVE-2026-54582?

The MidnightBSD Package Manager suffers from a vulnerability where prior to version 2.7.8, the lack of a preflight check during package installation exposes users to potential file overwrites. This occurs because the logic responsible for checking file conflicts does not enforce necessary safeguards against incoming non-directory assets, allowing a crafted or conflicting package to overwrite existing files. If the operator does not explicitly enable a force option, privileged installations can endanger local filesystem integrity and disrupt the consistency of the package database. The issue is addressed in version 2.7.8.

References