An M5 bolt is pretty strong. Thorn rates their expedition rack as having a capacity of 40 kg, but they rate that same rack as 60 kg capacity with 6mm bolts. (They also say cut those in half for South American Ripio.) I interpret that to mean that the M5 bolts are good enough for 40 kg on normal roads.

I assume you have a derailleur bike with rim brakes. On the drive side, use a long enough bolt that you can go through the fender mount (maybe a few washers too) and then the rack, then thread that into the frame. And make sure that the bolt is not too long to cause chain problems on the smallest sprocket. You might need to shorten the bolt with a hacksaw.

On the other side, you can mount it the same way - or since on the non-drive side you have more room inside the dropouts you could mount the rack on the outside of the dropout and the fender on the inside of the dropout and use a nut (nylock is best) on the inside to hold the fender bracket in place.