Vulnerability-Lookup

CVE-2026-59946 (GCVE-0-2026-59946)

Vulnerability from cvelistv5 – Published: 2026-07-08 19:32 – Updated: 2026-07-09 14:41

Title

Composer: Path traversal in package bin field lets dependencies chmod arbitrary host files

Summary

Composer is a dependency Manager for the PHP language. Prior to 2.2.29 and 2.10.2, a Composer package bin entry containing .. path segments can resolve outside the package install directory and cause Composer's binary installation flow to chmod an existing host file to a world-readable and world-executable mode during composer install, update, or require. This issue is fixed in versions 2.2.29 and 2.10.2.

Severity

6.1 (Medium)


                        
                          CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-07-09 14:21 UTC

CWE

CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CWE-732 - Incorrect Permission Assignment for Critical Resource

Assigner

GitHub_M mitre root

References

5 references

URL	Tags
https://github.com/composer/composer/security/adv…	x_refsource_CONFIRM
https://github.com/composer/composer/commit/502c6…	x_refsource_MISC
https://github.com/composer/composer/commit/c50b1…	x_refsource_MISC
https://github.com/composer/composer/releases/tag…	x_refsource_MISC
https://github.com/composer/composer/releases/tag…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version	CPE status
composer	composer	Affected: >= 1.0, < 2.2.29 Affected: >= 2.3.0, < 2.10.2	guessed

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-59946",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-07-09T14:21:07.902689Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-09T14:41:23.436Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "composer",
          "vendor": "composer",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 1.0, \u003c 2.2.29"
            },
            {
              "status": "affected",
              "version": "\u003e= 2.3.0, \u003c 2.10.2"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Composer is a dependency Manager for the PHP language. Prior to 2.2.29 and 2.10.2, a Composer package bin entry containing .. path segments can resolve outside the package install directory and cause Composer\u0027s binary installation flow to chmod an existing host file to a world-readable and world-executable mode during composer install, update, or require. This issue is fixed in versions 2.2.29 and 2.10.2."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "NONE",
            "baseScore": 6.1,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-22",
              "description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-732",
              "description": "CWE-732: Incorrect Permission Assignment for Critical Resource",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-08T19:32:38.089Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/composer/composer/security/advisories/GHSA-gjfg-22fp-rrxx",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/composer/composer/security/advisories/GHSA-gjfg-22fp-rrxx"
        },
        {
          "name": "https://github.com/composer/composer/commit/502c6c4f699802d9cf464728b3e8a95674f919a0",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/composer/composer/commit/502c6c4f699802d9cf464728b3e8a95674f919a0"
        },
        {
          "name": "https://github.com/composer/composer/commit/c50b1efd13ebd73f6dca19b31424c5a02bf93cc1",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/composer/composer/commit/c50b1efd13ebd73f6dca19b31424c5a02bf93cc1"
        },
        {
          "name": "https://github.com/composer/composer/releases/tag/2.10.2",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/composer/composer/releases/tag/2.10.2"
        },
        {
          "name": "https://github.com/composer/composer/releases/tag/2.2.29",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/composer/composer/releases/tag/2.2.29"
        }
      ],
      "source": {
        "advisory": "GHSA-gjfg-22fp-rrxx",
        "discovery": "UNKNOWN"
      },
      "title": "Composer: Path traversal in package bin field lets dependencies chmod arbitrary host files"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-59946",
    "datePublished": "2026-07-08T19:32:38.089Z",
    "dateReserved": "2026-07-07T18:49:15.607Z",
    "dateUpdated": "2026-07-09T14:41:23.436Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-59946",
      "date": "2026-09-18",
      "epss": "0.00172",
      "percentile": "0.06986"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "product": "composer",
                "vendor": "composer",
                "versions": [
                  {
                    "status": "affected",
                    "version": "\u003e= 1.0, \u003c 2.2.29"
                  },
                  {
                    "status": "affected",
                    "version": "\u003e= 2.3.0, \u003c 2.10.2"
                  }
                ]
              }
            ],
            "source": "security-advisories@github.com"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "Composer is a dependency Manager for the PHP language. Prior to 2.2.29 and 2.10.2, a Composer package bin entry containing .. path segments can resolve outside the package install directory and cause Composer\u0027s binary installation flow to chmod an existing host file to a world-readable and world-executable mode during composer install, update, or require. This issue is fixed in versions 2.2.29 and 2.10.2."
          }
        ],
        "id": "CVE-2026-59946",
        "lastModified": "2026-07-10T19:14:18.563",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "NONE",
                "baseScore": 6.1,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "LOW",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "REQUIRED",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 4.2,
              "source": "security-advisories@github.com",
              "type": "Secondary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2026-59946",
                "options": [
                  {
                    "exploitation": "none"
                  },
                  {
                    "automatable": "no"
                  },
                  {
                    "technicalImpact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-07-09T14:21:07.902689Z",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2026-07-08T20:16:59.707",
        "references": [
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/composer/composer/commit/502c6c4f699802d9cf464728b3e8a95674f919a0"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/composer/composer/commit/c50b1efd13ebd73f6dca19b31424c5a02bf93cc1"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/composer/composer/releases/tag/2.10.2"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/composer/composer/releases/tag/2.2.29"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/composer/composer/security/advisories/GHSA-gjfg-22fp-rrxx"
          }
        ],
        "sourceIdentifier": "security-advisories@github.com",
        "vulnStatus": "Deferred",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-22"
              },
              {
                "lang": "en",
                "value": "CWE-732"
              }
            ],
            "source": "security-advisories@github.com",
            "type": "Secondary"
          }
        ]
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-07-30T03:47:13+00:00",
      "cve": "CVE-2026-59946",
      "id": "CVE-2026-59946",
      "initial_release_date": "2026-07-08T19:32:38.089000+00:00",
      "product_status:fixed": "2",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "composer: Composer: Insecure file permissions leading to information disclosure and potential execution",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-59946.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-09-16T23:32:06Z",
      "cve": "CVE-2026-59946",
      "id": "CVE-2026-59946",
      "initial_release_date": "2026-07-10T03:11:49Z",
      "product_status:first_fixed": "4",
      "product_status:known_affected": "11",
      "product_status:recommended": "9",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-59946",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-59946.json",
      "version": "6"
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2026-59946",
                    "options": [
                      {
                        "Exploitation": "none"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "partial"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2026-07-09T14:21:07.902689Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2026-07-09T14:21:08.559Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "product": "composer",
              "vendor": "composer",
              "versions": [
                {
                  "status": "affected",
                  "version": "\u003e= 1.0, \u003c 2.2.29"
                },
                {
                  "status": "affected",
                  "version": "\u003e= 2.3.0, \u003c 2.10.2"
                }
              ]
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "Composer is a dependency Manager for the PHP language. Prior to 2.2.29 and 2.10.2, a Composer package bin entry containing .. path segments can resolve outside the package install directory and cause Composer\u0027s binary installation flow to chmod an existing host file to a world-readable and world-executable mode during composer install, update, or require. This issue is fixed in versions 2.2.29 and 2.10.2."
            }
          ],
          "metrics": [
            {
              "cvssV3_1": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "NONE",
                "baseScore": 6.1,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "LOW",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "REQUIRED",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N",
                "version": "3.1"
              }
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "cweId": "CWE-22",
                  "description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            },
            {
              "descriptions": [
                {
                  "cweId": "CWE-732",
                  "description": "CWE-732: Incorrect Permission Assignment for Critical Resource",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-07-08T19:32:38.089Z",
            "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
            "shortName": "GitHub_M"
          },
          "references": [
            {
              "name": "https://github.com/composer/composer/security/advisories/GHSA-gjfg-22fp-rrxx",
              "tags": [
                "x_refsource_CONFIRM"
              ],
              "url": "https://github.com/composer/composer/security/advisories/GHSA-gjfg-22fp-rrxx"
            },
            {
              "name": "https://github.com/composer/composer/commit/502c6c4f699802d9cf464728b3e8a95674f919a0",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/composer/composer/commit/502c6c4f699802d9cf464728b3e8a95674f919a0"
            },
            {
              "name": "https://github.com/composer/composer/commit/c50b1efd13ebd73f6dca19b31424c5a02bf93cc1",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/composer/composer/commit/c50b1efd13ebd73f6dca19b31424c5a02bf93cc1"
            },
            {
              "name": "https://github.com/composer/composer/releases/tag/2.10.2",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/composer/composer/releases/tag/2.10.2"
            },
            {
              "name": "https://github.com/composer/composer/releases/tag/2.2.29",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/composer/composer/releases/tag/2.2.29"
            }
          ],
          "source": {
            "advisory": "GHSA-gjfg-22fp-rrxx",
            "discovery": "UNKNOWN"
          },
          "title": "Composer: Path traversal in package bin field lets dependencies chmod arbitrary host files"
        }
      },
      "cveMetadata": {
        "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "assignerShortName": "GitHub_M",
        "cveId": "CVE-2026-59946",
        "datePublished": "2026-07-08T19:32:38.089Z",
        "dateReserved": "2026-07-07T18:49:15.607Z",
        "dateUpdated": "2026-07-09T14:41:23.436Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

bit-composer-2026-59946

Vulnerability from bitnami_vulndb

Published

2026-07-14 08:40

Modified

2026-07-27 06:08

Summary

Composer: Path traversal in package bin field lets dependencies chmod arbitrary host files

Details

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "Bitnami",
        "name": "composer",
        "purl": "pkg:bitnami/composer"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "1.0.0"
            },
            {
              "fixed": "2.2.29"
            },
            {
              "introduced": "2.3.0"
            },
            {
              "fixed": "2.10.2"
            }
          ],
          "type": "SEMVER"
        }
      ],
      "severity": [
        {
          "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N",
          "type": "CVSS_V3"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-59946"
  ],
  "database_specific": {
    "cpes": [
      "cpe:2.3:a:getcomposer:composer:*:*:*:*:*:*:*:*",
      "cpe:2.3:a:getcomposer:composer:*:*:*:*:*:php:*:*"
    ],
    "severity": "Medium"
  },
  "details": "Composer is a dependency Manager for the PHP language. Prior to 2.2.29 and 2.10.2, a Composer package bin entry containing .. path segments can resolve outside the package install directory and cause Composer\u0027s binary installation flow to chmod an existing host file to a world-readable and world-executable mode during composer install, update, or require. This issue is fixed in versions 2.2.29 and 2.10.2.",
  "id": "BIT-composer-2026-59946",
  "modified": "2026-07-27T06:08:49.409Z",
  "published": "2026-07-14T08:40:58.630Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/composer/composer/commit/502c6c4f699802d9cf464728b3e8a95674f919a0"
    },
    {
      "type": "WEB",
      "url": "https://github.com/composer/composer/commit/c50b1efd13ebd73f6dca19b31424c5a02bf93cc1"
    },
    {
      "type": "WEB",
      "url": "https://github.com/composer/composer/releases/tag/2.10.2"
    },
    {
      "type": "WEB",
      "url": "https://github.com/composer/composer/releases/tag/2.2.29"
    },
    {
      "type": "WEB",
      "url": "https://github.com/composer/composer/security/advisories/GHSA-gjfg-22fp-rrxx"
    },
    {
      "type": "WEB",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-59946"
    }
  ],
  "schema_version": "1.6.2",
  "summary": "Composer: Path traversal in package bin field lets dependencies chmod arbitrary host files"
}

CLEANSTART-2026-XS00515 (CVE-2026-59946)

Vulnerability from cleanstart – Published: 2026-09-18 09:29 – Updated: 2026-09-03 05:48 – Source website

Summary

Security fix for CVE-2026-59946 applied in: composer 2.10.2-r0

Details

Security vulnerability affects the composer package. This issue is resolved in later releases. See references for vulnerability details.

References

URL

Type

	https://github.com/cleanstart-dev/cleanstart-secu…	ADVISORY
	https://osv.dev/vulnerability/CVE-2026-59946	WEB
	https://nvd.nist.gov/vuln/detail/CVE-2026-59946	WEB

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "CleanStart",
        "name": "composer"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.10.2-r0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "credits": [],
  "database_specific": {},
  "details": "Security vulnerability affects the composer package. This issue is resolved in later releases. See references for vulnerability details.",
  "id": "CLEANSTART-2026-XS00515",
  "modified": "2026-09-03T05:48:18Z",
  "published": "2026-09-18T09:29:16.071249Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://github.com/cleanstart-dev/cleanstart-security-advisories/tree/main/advisories/2026/CLEANSTART-2026-XS00515.json"
    },
    {
      "type": "WEB",
      "url": "https://osv.dev/vulnerability/CVE-2026-59946"
    },
    {
      "type": "WEB",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-59946"
    }
  ],
  "related": [],
  "schema_version": "1.7.3",
  "summary": "Security fix for CVE-2026-59946 applied in: composer 2.10.2-r0",
  "upstream": [
    "CVE-2026-59946"
  ]
}

FKIE_CVE-2026-59946

Vulnerability from fkie_nvd - Published: 2026-07-08 20:16 - Updated: 2026-07-10 19:14

Severity

6.1 (Medium) - CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N

Summary

References

	URL	Tags
	security-advisories@github.com	https://github.com/composer/composer/commit/502c6c4f699802d9cf464728b3e8a95674f919a0
	security-advisories@github.com	https://github.com/composer/composer/commit/c50b1efd13ebd73f6dca19b31424c5a02bf93cc1
	security-advisories@github.com	https://github.com/composer/composer/releases/tag/2.10.2
	security-advisories@github.com	https://github.com/composer/composer/releases/tag/2.2.29
	security-advisories@github.com	https://github.com/composer/composer/security/advisories/GHSA-gjfg-22fp-rrxx

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "composer",
          "vendor": "composer",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 1.0, \u003c 2.2.29"
            },
            {
              "status": "affected",
              "version": "\u003e= 2.3.0, \u003c 2.10.2"
            }
          ]
        }
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Composer is a dependency Manager for the PHP language. Prior to 2.2.29 and 2.10.2, a Composer package bin entry containing .. path segments can resolve outside the package install directory and cause Composer\u0027s binary installation flow to chmod an existing host file to a world-readable and world-executable mode during composer install, update, or require. This issue is fixed in versions 2.2.29 and 2.10.2."
    }
  ],
  "id": "CVE-2026-59946",
  "lastModified": "2026-07-10T19:14:18.563",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "LOCAL",
          "availabilityImpact": "NONE",
          "baseScore": 6.1,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "LOW",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "REQUIRED",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 1.8,
        "impactScore": 4.2,
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-59946",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-07-09T14:21:07.902689Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-07-08T20:16:59.707",
  "references": [
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/composer/composer/commit/502c6c4f699802d9cf464728b3e8a95674f919a0"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/composer/composer/commit/c50b1efd13ebd73f6dca19b31424c5a02bf93cc1"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/composer/composer/releases/tag/2.10.2"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/composer/composer/releases/tag/2.2.29"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/composer/composer/security/advisories/GHSA-gjfg-22fp-rrxx"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-22"
        },
        {
          "lang": "en",
          "value": "CWE-732"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Secondary"
    }
  ]
}

GHSA-GJFG-22FP-RRXX

Vulnerability from github – Published: 2026-07-20 21:57 – Updated: 2026-07-20 21:57

Summary

Composer: Path traversal in package bin field lets dependencies chmod arbitrary host files

Details

Summary

A Composer package declares its executables in the bin field of its composer.json. When Composer installs a package, it processes each bin entry and changes the file mode of the corresponding file so it is executable.

If a bin entry contains .. path segments, it can resolve to a path outside the package's own install directory. A malicious package can use this to make Composer run chmod against a file that already exists elsewhere on the machine. The resulting mode is world-readable and world-executable (0755 under the common umask of 022). This happens when the package is installed, e.g. during composer install, composer update, and composer require. Any dependency can trigger it, including a transitive dependency several levels deep.

The vulnerability changes file permissions only, and does not read, modify, or execute the contents of the target file, and it is not remote code execution. The impact is to confidentiality: a file with deliberately restrictive permissions, such as a private key at mode 0600, can be made readable by other users on the same host.

Am I affected?

We reviewed packagist.org data and found no evidence that any published package exploited this vulnerability. If you install packages only from packagist.org, you are not affected by any known exploitation.

You are potentially affected if all of the following are true:

Your Composer project depends, directly or transitively, on a package you do not fully trust.
A file you rely on for its restrictive permissions already exists at a path the Composer process can write to. Examples include SSH private keys, .env files, ~/.aws/credentials, and .netrc.

The most likely way to be affected is to add or update a dependency that is malicious or has been compromised, then run an install on a machine that holds sensitive, permission-restricted files.

Two points to note:

--no-scripts, --no-plugins, and an allow-plugins allow-list do not prevent this. The permission change happens during normal binary installation, outside the plugin and script trust model.
Impact scales with privilege: As a regular user, only files owned by that user can be affected, which typically means your own secrets becoming readable by other local users on a shared machine. As root (for example, a CI container with no non-root user, or sudo composer install), any file on the system can be affected, including system credential stores.

Patched versions

The fix makes Composer reject any package whose binary entry contains a .. path segment. During install/update the operation aborts before any file permission is changed, and the same check now also applies when a package is published to Packagist.org, so such packages are refused upstream.

Fixed in 2.2.29 (2.2 LTS line) and 2.10.2 (current 2.x line). Composer 1.x is end of life and will not be patched. 1.x users should upgrade to a patched 2.x release.

Workarounds

Upgrading to a patched release is the only complete fix. There is no configuration option that disables the vulnerable behavior.

Severity

6.1 (Medium)


                  
                    CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "Packagist",
        "name": "composer/composer"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "2.3.0"
            },
            {
              "fixed": "2.10.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Packagist",
        "name": "composer/composer"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "1.0.0"
            },
            {
              "fixed": "2.2.29"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-59946"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-22",
      "CWE-732"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-07-20T21:57:40Z",
    "nvd_published_at": "2026-07-08T20:16:59Z",
    "severity": "MODERATE"
  },
  "details": "## Summary\n\nA Composer package declares its executables in the `bin` field of its `composer.json`. When Composer installs a package, it processes each `bin` entry and changes the file mode of the corresponding file so it is executable.\n\nIf a `bin` entry contains `..` path segments, it can resolve to a path outside the package\u0027s own install directory. A malicious package can use this to make Composer run `chmod` against a file that already exists elsewhere on the machine. The resulting mode is world-readable and world-executable (0755 under the common umask of 022). This happens when the package is installed, e.g. during `composer install`, `composer update`, and `composer require`. Any dependency can trigger it, including a transitive dependency several levels deep.\n\nThe vulnerability *changes file permissions only, and does not read, modify, or execute the contents of the target file, and it is not remote code execution*. The impact is to confidentiality: a file with deliberately restrictive permissions, such as a private key at mode 0600, can be made readable by other users on the same host.\n\n## Am I affected?\n\nWe reviewed packagist.org data and found no evidence that any published package exploited this vulnerability. If you install packages only from packagist.org, you are not affected by any known exploitation.\n\nYou are potentially affected if *all* of the following are true:\n\n- Your Composer project depends, directly or transitively, on a package you do not fully trust.\n- A file you rely on for its restrictive permissions already exists at a path the Composer process can write to. Examples include SSH private keys, `.env` files, `~/.aws/credentials`, and `.netrc`.\n\nThe most likely way to be affected is to add or update a dependency that is malicious or has been compromised, then run an install on a machine that holds sensitive, permission-restricted files.\n\nTwo points to note:\n\n- `--no-scripts`, `--no-plugins`, and an `allow-plugins` allow-list do not prevent this. The permission change happens during normal binary installation, outside the plugin and script trust model.\n- Impact scales with privilege: As a regular user, only files owned by that user can be affected, which typically means your own secrets becoming readable by other local users on a shared machine. As root (for example, a CI container with no non-root user, or `sudo composer install`), any file on the system can be affected, including system credential stores.\n\n## Patched versions\n\nThe fix makes Composer reject any package whose binary entry contains a `..` path segment. During install/update the operation aborts before any file permission is changed, and the same check now also applies when a package is published to Packagist.org, so such packages are refused upstream.\n\nFixed in 2.2.29 (2.2 LTS line) and 2.10.2 (current 2.x line). Composer 1.x is end of life and will not be patched. 1.x users should upgrade to a patched 2.x release.\n\n## Workarounds\n\nUpgrading to a patched release is the only complete fix. There is no configuration option that disables the vulnerable behavior.",
  "id": "GHSA-gjfg-22fp-rrxx",
  "modified": "2026-07-20T21:57:40Z",
  "published": "2026-07-20T21:57:40Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/composer/composer/security/advisories/GHSA-gjfg-22fp-rrxx"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-59946"
    },
    {
      "type": "WEB",
      "url": "https://github.com/composer/composer/commit/502c6c4f699802d9cf464728b3e8a95674f919a0"
    },
    {
      "type": "WEB",
      "url": "https://github.com/composer/composer/commit/c50b1efd13ebd73f6dca19b31424c5a02bf93cc1"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/composer/composer"
    },
    {
      "type": "WEB",
      "url": "https://github.com/composer/composer/releases/tag/2.10.2"
    },
    {
      "type": "WEB",
      "url": "https://github.com/composer/composer/releases/tag/2.2.29"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Composer: Path traversal in package bin field lets dependencies chmod arbitrary host files"
}

OPENSUSE-SU-2026:11268-1

Vulnerability from csaf_opensuse - Published: 2026-07-14 00:00 - Updated: 2026-09-17 17:14

Summary

php-composer2-2.10.2-1.1 on GA media

Severity

Moderate

Scope

3 vulnerabilities in this advisory, including CVE-2026-59946.

CVE-2026-59946

5.5 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Recommended: 4 products

Open the full advisory

OPENSUSE-SU-2026:21520-1

Vulnerability from csaf_opensuse - Published: 2026-08-03 21:09 - Updated: 2026-09-17 17:41

Summary

Security update for php-composer2

Severity

Important

Scope

7 vulnerabilities in this advisory, including CVE-2026-59946.

CVE-2026-59946

5.5 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Recommended: 1 product

Open the full advisory

RHSA-2026:34854

Vulnerability from csaf_redhat - Published: 2026-07-02 08:56 - Updated: 2026-09-06 05:29

Summary

Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

Severity

Moderate

Scope

1 vulnerability in this advisory, including CVE-2026-59946.

CVE-2026-59946

A flaw was found in Composer, a dependency manager for PHP. A malicious package can exploit a vulnerability in Composer's binary installation process by using specially crafted path segments. This allows an existing file on the host system to have its permissions changed to be world-readable and world-executable. This can lead to sensitive information disclosure and potentially allow an attacker to execute arbitrary code.

5.6 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:L/A:N

Fixed: 2 products

https://access.redhat.com/errata/RHSA-2026:34854

Open the full advisory

SUSE-SU-2026:23116-1

Vulnerability from csaf_suse - Published: 2026-08-03 21:09 - Updated: 2026-09-16 20:11

Summary

Security update for php-composer2

Severity

Important

Scope

7 vulnerabilities in this advisory, including CVE-2026-59946.

CVE-2026-59946

5.5 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Recommended: 2 products

Open the full advisory

SUSE-SU-2026:23138-1

Vulnerability from csaf_suse - Published: 2026-08-03 21:09 - Updated: 2026-09-16 20:11

Summary

Security update for php-composer2

Severity

Important

Scope

7 vulnerabilities in this advisory, including CVE-2026-59946.

CVE-2026-59946

5.5 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Recommended: 2 products

Open the full advisory

UBUNTU-CVE-2026-59946 (CVE-2026-59946)

Vulnerability from osv_ubuntu – Published: 2026-07-08 20:16 – Updated: 2026-07-15 17:53 – Source website

Details

Severity

6.1 (Medium)


                    
                      CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N

N/A (UNKNOWN)


                    
                      medium

References

URL

Type

	https://ubuntu.com/security/CVE-2026-59946	REPORT
	https://www.cve.org/CVERecord?id=CVE-2026-59946	REPORT
	https://github.com/composer/composer/security/adv…	REPORT

JSON

To clipboard

{
  "affected": [
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "composer",
            "binary_version": "1.0.0~beta2-1ubuntu0.1~esm2"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:Pro:16.04:LTS",
        "name": "composer",
        "purl": "pkg:deb/ubuntu/composer@1.0.0~beta2-1ubuntu0.1~esm2?arch=source\u0026distro=esm-apps/xenial"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "1.0.0~alpha10+20150602-1",
        "1.0.0~alpha10+20150602-2",
        "1.0.0~alpha11-1",
        "1.0.0~alpha11-1ubuntu1",
        "1.0.0~alpha11-2",
        "1.0.0~alpha11-3",
        "1.0.0~beta1-1ubuntu1",
        "1.0.0~beta2-1",
        "1.0.0~beta2-1ubuntu0.1~esm1",
        "1.0.0~beta2-1ubuntu0.1~esm2"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "composer",
            "binary_version": "1.6.3-1ubuntu0.1~esm2"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:Pro:18.04:LTS",
        "name": "composer",
        "purl": "pkg:deb/ubuntu/composer@1.6.3-1ubuntu0.1~esm2?arch=source\u0026distro=esm-apps/bionic"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "1.5.1-1",
        "1.5.2-1",
        "1.6.2-1",
        "1.6.3-1",
        "1.6.3-1ubuntu0.1~esm1",
        "1.6.3-1ubuntu0.1~esm2"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "composer",
            "binary_version": "1.10.1-1ubuntu0.1~esm2"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:Pro:20.04:LTS",
        "name": "composer",
        "purl": "pkg:deb/ubuntu/composer@1.10.1-1ubuntu0.1~esm2?arch=source\u0026distro=esm-apps/focal"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "1.9.0-2",
        "1.9.1-1",
        "1.9.2-1",
        "1.9.3-1",
        "1.10.0-1",
        "1.10.1-1",
        "1.10.1-1ubuntu0.1~esm1",
        "1.10.1-1ubuntu0.1~esm2"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "composer",
            "binary_version": "2.2.6-2ubuntu4+esm1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:Pro:22.04:LTS",
        "name": "composer",
        "purl": "pkg:deb/ubuntu/composer@2.2.6-2ubuntu4+esm1?arch=source\u0026distro=esm-apps/jammy"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "2.0.9-2ubuntu2",
        "2.0.9-2ubuntu3",
        "2.0.13-1ubuntu1",
        "2.1.12-1ubuntu1",
        "2.2.6-2ubuntu4",
        "2.2.6-2ubuntu4+esm1"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "composer",
            "binary_version": "2.7.1-2ubuntu0.1~esm1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:Pro:24.04:LTS",
        "name": "composer",
        "purl": "pkg:deb/ubuntu/composer@2.7.1-2ubuntu0.1~esm1?arch=source\u0026distro=esm-apps/noble"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "2.5.8-1",
        "2.6.5-1",
        "2.6.6-1",
        "2.7.1-2",
        "2.7.1-2ubuntu0.1~esm1"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "composer",
            "binary_version": "2.8.8-1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:25.10",
        "name": "composer",
        "purl": "pkg:deb/ubuntu/composer@2.8.8-1?arch=source\u0026distro=questing"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "2.8.6-1",
        "2.8.8-1"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "composer",
            "binary_version": "2.9.5-1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:26.04:LTS",
        "name": "composer",
        "purl": "pkg:deb/ubuntu/composer@2.9.5-1?arch=source\u0026distro=resolute"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "2.8.8-1",
        "2.9.5-1"
      ]
    }
  ],
  "aliases": [],
  "details": "Composer is a dependency Manager for the PHP language. Prior to 2.2.29 and 2.10.2, a Composer package bin entry containing .. path segments can resolve outside the package install directory and cause Composer\u0027s binary installation flow to chmod an existing host file to a world-readable and world-executable mode during composer install, update, or require. This issue is fixed in versions 2.2.29 and 2.10.2.",
  "id": "UBUNTU-CVE-2026-59946",
  "modified": "2026-07-15T17:53:45Z",
  "published": "2026-07-08T20:16:00Z",
  "references": [
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2026-59946"
    },
    {
      "type": "REPORT",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-59946"
    },
    {
      "type": "REPORT",
      "url": "https://github.com/composer/composer/security/advisories/GHSA-gjfg-22fp-rrxx"
    }
  ],
  "related": [],
  "schema_version": "1.7.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N",
      "type": "CVSS_V3"
    },
    {
      "score": "medium",
      "type": "Ubuntu"
    }
  ],
  "upstream": [
    "CVE-2026-59946"
  ]
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CVE-2026-59946 (GCVE-0-2026-59946)

Vulnerability from bitnami_vulndb

CLEANSTART-2026-XS00515 (CVE-2026-59946)

Summary

Am I affected?

Patched versions

Workarounds

UBUNTU-CVE-2026-59946 (CVE-2026-59946)

Tags

Sightings

Nomenclature

Related by attack behaviour