The vulnerability arises because mport uses the TMPDIR environment variable to locate temporary files used during package metadata extraction even when it runs with elevated privileges or as a setuid binary. This design flaw allows an attacker who can set environment variables for a privileged mport invocation to direct the extraction to an arbitrary directory controlled by the attacker. By doing so, the attacker can influence the location where sensitive metadata files are written, potentially enabling the placement of malicious content or the modification of files that are later processed during package installation. The flaw is identified as CWE-377 and CWE-73.

MidnightBSD mport, the package manager for the MidnightBSD operating system, is affected. The issue exists in all releases prior to version 2.7.8. Both the pre‑2.7.8 and earlier stable series use the vulnerable TMPDIR handling in privileged contexts.

The CVSS score of 5.3 classifies the vulnerability as medium severity. The EPSS score is not available, indicating no publicly known exploit data, and the risk is not listed in the CISA KEV. The likely attack vector is local exploitation, requiring the attacker to control the environment for a privileged invocation of mport, such as through a compromised user session or by running mport with setuid permissions in a malicious environment. After patching to 2.7.8, the temporary directory is validated and any empty or unsafe TMPDIR values are rejected, removing the attack surface.