The vulnerability in mport versions before 2.7.8 arises from the use of path-based lstat(), chown(), stat(), and chmod() system calls in the do_actual_install() function during package installation. Because these operations do not securely handle symbolic links, a local attacker with write permissions in the target directory can substitute a file with a symlink after the initial checks but before ownership or permission changes are applied. This allows the attacker to redirect these privileged changes to arbitrary filesystem locations, risking unauthorized modification of file ownership or permissions. The issue is addressed by fixes introduced in mport version 2.7.8.

A local attacker with write access to the target directory can exploit this vulnerability to redirect privileged ownership and permission changes to attacker-controlled paths. This can lead to compromised filesystem integrity or unauthorized permission escalation on files outside the intended package installation scope. The vulnerability requires local access and write permissions, and the attack complexity is high due to timing requirements.

Upgrade mport to version 2.7.8 or later, where this vulnerability is fixed. No other mitigation is necessary as the issue is resolved in the official patch.