Directory Traversal Vulnerability in MidnightBSD Package Manager

CVE-2026-54583

What is CVE-2026-54583?

The MidnightBSD Package Manager, prior to version 2.7.8, contains a directory traversal vulnerability due to improper validation in libmport/fetch.c. This flaw arises when the system fails to consistently reject invalid filenames, such as empty strings or those containing directory traversal characters (e.g., '../'). Consequently, malicious package index data may lead to unsafe locations being targeted for package downloads, potentially allowing writes outside of designated cache paths. Version 2.7.8 resolves this issue with improved validation checks.

References