The vulnerability in mport versions before 2.7.8 arises from missing preflight checks for non-directory assets that already exist on disk during package installation. Specifically, the logic in libmport/check_preconditions.c, libmport/install_primative.c, and libmport/mport_private.h did not enforce the MPORT_PRECHECK_FILE_CONFLICTS check. This omission allows a crafted or conflicting package to overwrite files owned by other packages or unmanaged by mport, potentially compromising local filesystem integrity and the consistency of the package database. The check is bypassed only if the operator explicitly enables the force option (mport->force). The issue is resolved in version 2.7.8.

An attacker able to install packages without the force override could cause overwriting of files owned by other packages or unmanaged files, leading to compromised filesystem integrity and inconsistent package database state. This could affect system stability and security, but exploitation requires operator interaction and privileges to install packages.

Upgrade mport to version 2.7.8 or later, where the vulnerability is fixed. Avoid using the force option during package installation unless absolutely necessary, as it bypasses the file conflict checks. Patch status is confirmed fixed in 2.7.8.