MidnightBSD's mport package manager versions before 2.7.8 used the TMPDIR environment variable when extracting package metafiles, including during privileged operations such as running as root or in setuid/setgid contexts. An attacker with the ability to influence the environment of a privileged mport invocation could exploit this to redirect temporary metadata extraction to an attacker-controlled path. The patch in version 2.7.8 addresses this by ignoring unsafe TMPDIR values in privileged contexts and rejecting empty TMPDIR values, mitigating the risk of external control of file name or path (CWE-73).

An attacker able to control the environment for a privileged mport execution could redirect temporary file extraction to an attacker-controlled location, potentially leading to unauthorized file manipulation or privilege escalation. The CVSS 4.0 base score is 5.3 (medium severity), reflecting network attack vector, low complexity, no privileges required, and limited confidentiality impact.

Upgrade mport to version 2.7.8 or later, where the vulnerability has been patched by ignoring unsafe TMPDIR environment variable values in privileged contexts and rejecting empty TMPDIR. No other mitigation is required as the issue is fixed in the official release.