Vulnerability-Lookup

CVE-2026-59948 (GCVE-0-2026-59948)

Vulnerability from cvelistv5 – Published: 2026-07-08 19:33 – Updated: 2026-07-09 14:32

Title

Composer: Arbitrary file write outside vendor via malicious transitive package name

Summary

Composer is a dependency Manager for the PHP language. Prior to 2.2.29 and 2.10.2, a maliciously crafted package from an untrusted repository other than Packagist.org or Private Packagist can cause Composer to write attacker-controlled files outside the vendor directory and outside the project during install or update by using an invalid package name that is not correctly validated before dependency-resolution results are written or installed. This issue is fixed in versions 2.2.29 and 2.10.2.

Severity

7 (High)


                        
                          CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-07-09 14:32 UTC

CWE

CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CWE-787 - Out-of-bounds Write

Assigner

GitHub_M mitre root

References

5 references

URL	Tags
https://github.com/composer/composer/security/adv…	x_refsource_CONFIRM
https://github.com/composer/composer/commit/502c6…	x_refsource_MISC
https://github.com/composer/composer/commit/c50b1…	x_refsource_MISC
https://github.com/composer/composer/releases/tag…	x_refsource_MISC
https://github.com/composer/composer/releases/tag…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version	CPE status
composer	composer	Affected: >= 1.0, < 2.2.29 Affected: >= 2.3.0, < 2.10.2	guessed

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-59948",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-07-09T14:32:00.579490Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-09T14:32:07.719Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "composer",
          "vendor": "composer",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 1.0, \u003c 2.2.29"
            },
            {
              "status": "affected",
              "version": "\u003e= 2.3.0, \u003c 2.10.2"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Composer is a dependency Manager for the PHP language. Prior to 2.2.29 and 2.10.2, a maliciously crafted package from an untrusted repository other than Packagist.org or Private Packagist can cause Composer to write attacker-controlled files outside the vendor directory and outside the project during install or update by using an invalid package name that is not correctly validated before dependency-resolution results are written or installed. This issue is fixed in versions 2.2.29 and 2.10.2."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 7,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-22",
              "description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-787",
              "description": "CWE-787: Out-of-bounds Write",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-08T19:33:48.414Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/composer/composer/security/advisories/GHSA-499r-g7pc-vmp9",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/composer/composer/security/advisories/GHSA-499r-g7pc-vmp9"
        },
        {
          "name": "https://github.com/composer/composer/commit/502c6c4f699802d9cf464728b3e8a95674f919a0",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/composer/composer/commit/502c6c4f699802d9cf464728b3e8a95674f919a0"
        },
        {
          "name": "https://github.com/composer/composer/commit/c50b1efd13ebd73f6dca19b31424c5a02bf93cc1",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/composer/composer/commit/c50b1efd13ebd73f6dca19b31424c5a02bf93cc1"
        },
        {
          "name": "https://github.com/composer/composer/releases/tag/2.10.2",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/composer/composer/releases/tag/2.10.2"
        },
        {
          "name": "https://github.com/composer/composer/releases/tag/2.2.29",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/composer/composer/releases/tag/2.2.29"
        }
      ],
      "source": {
        "advisory": "GHSA-499r-g7pc-vmp9",
        "discovery": "UNKNOWN"
      },
      "title": "Composer: Arbitrary file write outside vendor via malicious transitive package name"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-59948",
    "datePublished": "2026-07-08T19:33:48.414Z",
    "dateReserved": "2026-07-07T18:49:15.607Z",
    "dateUpdated": "2026-07-09T14:32:07.719Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-59948",
      "date": "2026-09-18",
      "epss": "0.00164",
      "percentile": "0.06068"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "product": "composer",
                "vendor": "composer",
                "versions": [
                  {
                    "status": "affected",
                    "version": "\u003e= 1.0, \u003c 2.2.29"
                  },
                  {
                    "status": "affected",
                    "version": "\u003e= 2.3.0, \u003c 2.10.2"
                  }
                ]
              }
            ],
            "source": "security-advisories@github.com"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "Composer is a dependency Manager for the PHP language. Prior to 2.2.29 and 2.10.2, a maliciously crafted package from an untrusted repository other than Packagist.org or Private Packagist can cause Composer to write attacker-controlled files outside the vendor directory and outside the project during install or update by using an invalid package name that is not correctly validated before dependency-resolution results are written or installed. This issue is fixed in versions 2.2.29 and 2.10.2."
          }
        ],
        "id": "CVE-2026-59948",
        "lastModified": "2026-07-10T19:14:18.563",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "HIGH",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 7.0,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "REQUIRED",
                "vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.0,
              "impactScore": 5.9,
              "source": "security-advisories@github.com",
              "type": "Secondary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2026-59948",
                "options": [
                  {
                    "exploitation": "none"
                  },
                  {
                    "automatable": "no"
                  },
                  {
                    "technicalImpact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-07-09T14:32:00.579490Z",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2026-07-08T20:16:59.980",
        "references": [
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/composer/composer/commit/502c6c4f699802d9cf464728b3e8a95674f919a0"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/composer/composer/commit/c50b1efd13ebd73f6dca19b31424c5a02bf93cc1"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/composer/composer/releases/tag/2.10.2"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/composer/composer/releases/tag/2.2.29"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/composer/composer/security/advisories/GHSA-499r-g7pc-vmp9"
          }
        ],
        "sourceIdentifier": "security-advisories@github.com",
        "vulnStatus": "Deferred",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-22"
              },
              {
                "lang": "en",
                "value": "CWE-787"
              }
            ],
            "source": "security-advisories@github.com",
            "type": "Secondary"
          }
        ]
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-07-29T13:33:13+00:00",
      "cve": "CVE-2026-59948",
      "id": "CVE-2026-59948",
      "initial_release_date": "2026-07-08T19:33:48.414000+00:00",
      "product_status:known_not_affected": "1",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "composer/composer: Composer: Arbitrary file write via crafted package name",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-59948.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "important",
      "current_release_date": "2026-09-16T23:32:01Z",
      "cve": "CVE-2026-59948",
      "id": "CVE-2026-59948",
      "initial_release_date": "2026-07-10T03:11:46Z",
      "product_status:first_fixed": "4",
      "product_status:known_affected": "11",
      "product_status:recommended": "9",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-59948",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-59948.json",
      "version": "7"
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2026-59948",
                    "options": [
                      {
                        "Exploitation": "none"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "total"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2026-07-09T14:32:00.579490Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2026-07-09T14:32:04.008Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "product": "composer",
              "vendor": "composer",
              "versions": [
                {
                  "status": "affected",
                  "version": "\u003e= 1.0, \u003c 2.2.29"
                },
                {
                  "status": "affected",
                  "version": "\u003e= 2.3.0, \u003c 2.10.2"
                }
              ]
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "Composer is a dependency Manager for the PHP language. Prior to 2.2.29 and 2.10.2, a maliciously crafted package from an untrusted repository other than Packagist.org or Private Packagist can cause Composer to write attacker-controlled files outside the vendor directory and outside the project during install or update by using an invalid package name that is not correctly validated before dependency-resolution results are written or installed. This issue is fixed in versions 2.2.29 and 2.10.2."
            }
          ],
          "metrics": [
            {
              "cvssV3_1": {
                "attackComplexity": "HIGH",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 7,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "REQUIRED",
                "vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
                "version": "3.1"
              }
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "cweId": "CWE-22",
                  "description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            },
            {
              "descriptions": [
                {
                  "cweId": "CWE-787",
                  "description": "CWE-787: Out-of-bounds Write",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-07-08T19:33:48.414Z",
            "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
            "shortName": "GitHub_M"
          },
          "references": [
            {
              "name": "https://github.com/composer/composer/security/advisories/GHSA-499r-g7pc-vmp9",
              "tags": [
                "x_refsource_CONFIRM"
              ],
              "url": "https://github.com/composer/composer/security/advisories/GHSA-499r-g7pc-vmp9"
            },
            {
              "name": "https://github.com/composer/composer/commit/502c6c4f699802d9cf464728b3e8a95674f919a0",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/composer/composer/commit/502c6c4f699802d9cf464728b3e8a95674f919a0"
            },
            {
              "name": "https://github.com/composer/composer/commit/c50b1efd13ebd73f6dca19b31424c5a02bf93cc1",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/composer/composer/commit/c50b1efd13ebd73f6dca19b31424c5a02bf93cc1"
            },
            {
              "name": "https://github.com/composer/composer/releases/tag/2.10.2",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/composer/composer/releases/tag/2.10.2"
            },
            {
              "name": "https://github.com/composer/composer/releases/tag/2.2.29",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/composer/composer/releases/tag/2.2.29"
            }
          ],
          "source": {
            "advisory": "GHSA-499r-g7pc-vmp9",
            "discovery": "UNKNOWN"
          },
          "title": "Composer: Arbitrary file write outside vendor via malicious transitive package name"
        }
      },
      "cveMetadata": {
        "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "assignerShortName": "GitHub_M",
        "cveId": "CVE-2026-59948",
        "datePublished": "2026-07-08T19:33:48.414Z",
        "dateReserved": "2026-07-07T18:49:15.607Z",
        "dateUpdated": "2026-07-08T19:33:48.414Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

bit-composer-2026-59948

Vulnerability from bitnami_vulndb

Published

2026-07-14 08:41

Modified

2026-07-27 06:08

Summary

Composer: Arbitrary file write outside vendor via malicious transitive package name

Details

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "Bitnami",
        "name": "composer",
        "purl": "pkg:bitnami/composer"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "1.0.0"
            },
            {
              "fixed": "2.2.29"
            },
            {
              "introduced": "2.3.0"
            },
            {
              "fixed": "2.10.2"
            }
          ],
          "type": "SEMVER"
        }
      ],
      "severity": [
        {
          "score": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
          "type": "CVSS_V3"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-59948"
  ],
  "database_specific": {
    "cpes": [
      "cpe:2.3:a:getcomposer:composer:*:*:*:*:*:*:*:*",
      "cpe:2.3:a:getcomposer:composer:*:*:*:*:*:php:*:*"
    ],
    "severity": "High"
  },
  "details": "Composer is a dependency Manager for the PHP language. Prior to 2.2.29 and 2.10.2, a maliciously crafted package from an untrusted repository other than Packagist.org or Private Packagist can cause Composer to write attacker-controlled files outside the vendor directory and outside the project during install or update by using an invalid package name that is not correctly validated before dependency-resolution results are written or installed. This issue is fixed in versions 2.2.29 and 2.10.2.",
  "id": "BIT-composer-2026-59948",
  "modified": "2026-07-27T06:08:49.409Z",
  "published": "2026-07-14T08:41:01.133Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/composer/composer/commit/502c6c4f699802d9cf464728b3e8a95674f919a0"
    },
    {
      "type": "WEB",
      "url": "https://github.com/composer/composer/commit/c50b1efd13ebd73f6dca19b31424c5a02bf93cc1"
    },
    {
      "type": "WEB",
      "url": "https://github.com/composer/composer/releases/tag/2.10.2"
    },
    {
      "type": "WEB",
      "url": "https://github.com/composer/composer/releases/tag/2.2.29"
    },
    {
      "type": "WEB",
      "url": "https://github.com/composer/composer/security/advisories/GHSA-499r-g7pc-vmp9"
    },
    {
      "type": "WEB",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-59948"
    }
  ],
  "schema_version": "1.6.2",
  "summary": "Composer: Arbitrary file write outside vendor via malicious transitive package name"
}

CLEANSTART-2026-UO36556 (CVE-2026-59948)

Vulnerability from cleanstart – Published: 2026-09-18 09:29 – Updated: 2026-09-03 05:48 – Source website

Summary

Security fix for CVE-2026-59948 applied in: composer 2.10.2-r0

Details

Security vulnerability affects the composer package. This issue is resolved in later releases. See references for vulnerability details.

References

URL

Type

	https://github.com/cleanstart-dev/cleanstart-secu…	ADVISORY
	https://osv.dev/vulnerability/CVE-2026-59948	WEB
	https://nvd.nist.gov/vuln/detail/CVE-2026-59948	WEB

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "CleanStart",
        "name": "composer"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.10.2-r0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "credits": [],
  "database_specific": {},
  "details": "Security vulnerability affects the composer package. This issue is resolved in later releases. See references for vulnerability details.",
  "id": "CLEANSTART-2026-UO36556",
  "modified": "2026-09-03T05:48:18Z",
  "published": "2026-09-18T09:29:15.836487Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://github.com/cleanstart-dev/cleanstart-security-advisories/tree/main/advisories/2026/CLEANSTART-2026-UO36556.json"
    },
    {
      "type": "WEB",
      "url": "https://osv.dev/vulnerability/CVE-2026-59948"
    },
    {
      "type": "WEB",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-59948"
    }
  ],
  "related": [],
  "schema_version": "1.7.3",
  "summary": "Security fix for CVE-2026-59948 applied in: composer 2.10.2-r0",
  "upstream": [
    "CVE-2026-59948"
  ]
}

FKIE_CVE-2026-59948

Vulnerability from fkie_nvd - Published: 2026-07-08 20:16 - Updated: 2026-07-10 19:14

Severity

7.0 (High) - CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

Summary

References

	URL	Tags
	security-advisories@github.com	https://github.com/composer/composer/commit/502c6c4f699802d9cf464728b3e8a95674f919a0
	security-advisories@github.com	https://github.com/composer/composer/commit/c50b1efd13ebd73f6dca19b31424c5a02bf93cc1
	security-advisories@github.com	https://github.com/composer/composer/releases/tag/2.10.2
	security-advisories@github.com	https://github.com/composer/composer/releases/tag/2.2.29
	security-advisories@github.com	https://github.com/composer/composer/security/advisories/GHSA-499r-g7pc-vmp9

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "composer",
          "vendor": "composer",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 1.0, \u003c 2.2.29"
            },
            {
              "status": "affected",
              "version": "\u003e= 2.3.0, \u003c 2.10.2"
            }
          ]
        }
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Composer is a dependency Manager for the PHP language. Prior to 2.2.29 and 2.10.2, a maliciously crafted package from an untrusted repository other than Packagist.org or Private Packagist can cause Composer to write attacker-controlled files outside the vendor directory and outside the project during install or update by using an invalid package name that is not correctly validated before dependency-resolution results are written or installed. This issue is fixed in versions 2.2.29 and 2.10.2."
    }
  ],
  "id": "CVE-2026-59948",
  "lastModified": "2026-07-10T19:14:18.563",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "HIGH",
          "attackVector": "LOCAL",
          "availabilityImpact": "HIGH",
          "baseScore": 7.0,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "REQUIRED",
          "vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 1.0,
        "impactScore": 5.9,
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-59948",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-07-09T14:32:00.579490Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-07-08T20:16:59.980",
  "references": [
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/composer/composer/commit/502c6c4f699802d9cf464728b3e8a95674f919a0"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/composer/composer/commit/c50b1efd13ebd73f6dca19b31424c5a02bf93cc1"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/composer/composer/releases/tag/2.10.2"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/composer/composer/releases/tag/2.2.29"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/composer/composer/security/advisories/GHSA-499r-g7pc-vmp9"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-22"
        },
        {
          "lang": "en",
          "value": "CWE-787"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Secondary"
    }
  ]
}

GHSA-499R-G7PC-VMP9

Vulnerability from github – Published: 2026-07-20 19:15 – Updated: 2026-07-20 19:15

Summary

Composer: Arbitrary file write outside vendor via malicious transitive package name

Details

Summary

A maliciously crafted package, published on an untrusted third party repository other than Packagist.org or Private Packagist, can cause Composer to write files outside the vendor/ directory and outside your project, with attacker-controlled content, during a normal install or update through using an invalid package name, which was not correctly validated by Composer.

This is an arbitrary file write that can be used to execute code outside the Composer project's context in which you expected the package code to execute (for example by writing shell startup files, SSH authorized_keys, or a cron entry). It is a supply-chain issue: it requires a malicious or compromised package to be present in the dependency graph, it is not otherwise remotely exploitable against a machine.

The fix makes Composer validate every package produced by dependency resolution before anything is written to composer.lock or installed, and abort with a security error if a package name is not a valid vendor/package name.

Am I affected?

You may be affected if you install packages from an untrusted third party repository, which does not sufficiently validate package names. Packagist.org and Private Packagist are safe, as they validate package names correctly.

Patched versions

Fixed in 2.2.29 and 2.10.2. Composer 1.x is also affected and you should move to a safe 2.x release.

Workarounds

Do not use untrusted package repositories. If you have to, mirror them through an internal repository like Private Packagist.

Severity

7.0 (High)


                  
                    CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "Packagist",
        "name": "composer/composer"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "2.3.0"
            },
            {
              "fixed": "2.10.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Packagist",
        "name": "composer/composer"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "1.0.0"
            },
            {
              "fixed": "2.2.29"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-59948"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-22",
      "CWE-787"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-07-20T19:15:29Z",
    "nvd_published_at": "2026-07-08T20:16:59Z",
    "severity": "HIGH"
  },
  "details": "## Summary\n\nA maliciously crafted package, published on an untrusted third party repository other than Packagist.org or Private Packagist, can cause Composer to write files outside the `vendor/` directory and outside your project, with attacker-controlled content, during a normal `install` or `update` through using an invalid package name, which was not correctly validated by Composer.\n\nThis is an arbitrary file write that can be used to execute code outside the Composer project\u0027s context in which you expected the package code to execute (for example by writing shell startup files, SSH `authorized_keys`, or a cron entry). It is a supply-chain issue: it requires a malicious or compromised package to be present in the dependency graph, it is not otherwise remotely exploitable against a machine.\n\nThe fix makes Composer validate every package produced by dependency resolution before anything is written to `composer.lock` or installed, and abort with a security error if a package name is not a valid `vendor/package` name.\n\n## Am I affected?\n\nYou may be affected if you install packages from an untrusted third party repository, which does not sufficiently validate package names. Packagist.org and Private Packagist are safe, as they validate package names correctly.\n\n## Patched versions\n\nFixed in **2.2.29** and **2.10.2**. Composer 1.x is also affected and you should move to a safe 2.x release.\n\n## Workarounds\n\nDo not use untrusted package repositories. If you have to, mirror them through an internal repository like Private Packagist.",
  "id": "GHSA-499r-g7pc-vmp9",
  "modified": "2026-07-20T19:15:29Z",
  "published": "2026-07-20T19:15:29Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/composer/composer/security/advisories/GHSA-499r-g7pc-vmp9"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-59948"
    },
    {
      "type": "WEB",
      "url": "https://github.com/composer/composer/commit/502c6c4f699802d9cf464728b3e8a95674f919a0"
    },
    {
      "type": "WEB",
      "url": "https://github.com/composer/composer/commit/c50b1efd13ebd73f6dca19b31424c5a02bf93cc1"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/composer/composer"
    },
    {
      "type": "WEB",
      "url": "https://github.com/composer/composer/releases/tag/2.10.2"
    },
    {
      "type": "WEB",
      "url": "https://github.com/composer/composer/releases/tag/2.2.29"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Composer: Arbitrary file write outside vendor via malicious transitive package name"
}

OPENSUSE-SU-2026:11268-1

Vulnerability from csaf_opensuse - Published: 2026-07-14 00:00 - Updated: 2026-09-17 17:14

Summary

php-composer2-2.10.2-1.1 on GA media

Severity

Moderate

Scope

3 vulnerabilities in this advisory, including CVE-2026-59948.

CVE-2026-59948

7 (High)


                
                  CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

Recommended: 4 products

Open the full advisory

OPENSUSE-SU-2026:21520-1

Vulnerability from csaf_opensuse - Published: 2026-08-03 21:09 - Updated: 2026-09-17 17:41

Summary

Security update for php-composer2

Severity

Important

Scope

7 vulnerabilities in this advisory, including CVE-2026-59948.

CVE-2026-59948

7 (High)


                
                  CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

Recommended: 1 product

Open the full advisory

SUSE-SU-2026:23116-1

Vulnerability from csaf_suse - Published: 2026-08-03 21:09 - Updated: 2026-09-16 20:11

Summary

Security update for php-composer2

Severity

Important

Scope

7 vulnerabilities in this advisory, including CVE-2026-59948.

CVE-2026-59948

7 (High)


                
                  CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

Recommended: 2 products

Open the full advisory

SUSE-SU-2026:23138-1

Vulnerability from csaf_suse - Published: 2026-08-03 21:09 - Updated: 2026-09-16 20:11

Summary

Security update for php-composer2

Severity

Important

Scope

7 vulnerabilities in this advisory, including CVE-2026-59948.

CVE-2026-59948

7 (High)


                
                  CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

Recommended: 2 products

Open the full advisory

UBUNTU-CVE-2026-59948 (CVE-2026-59948)

Vulnerability from osv_ubuntu – Published: 2026-07-08 20:16 – Updated: 2026-07-15 17:53 – Source website

Details

Severity

7.0 (High)


                    
                      CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

N/A (UNKNOWN)


                    
                      medium

References

URL

Type

	https://ubuntu.com/security/CVE-2026-59948	REPORT
	https://www.cve.org/CVERecord?id=CVE-2026-59948	REPORT
	https://github.com/composer/composer/security/adv…	REPORT

JSON

To clipboard

{
  "affected": [
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "composer",
            "binary_version": "1.0.0~beta2-1ubuntu0.1~esm2"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:Pro:16.04:LTS",
        "name": "composer",
        "purl": "pkg:deb/ubuntu/composer@1.0.0~beta2-1ubuntu0.1~esm2?arch=source\u0026distro=esm-apps/xenial"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "1.0.0~alpha10+20150602-1",
        "1.0.0~alpha10+20150602-2",
        "1.0.0~alpha11-1",
        "1.0.0~alpha11-1ubuntu1",
        "1.0.0~alpha11-2",
        "1.0.0~alpha11-3",
        "1.0.0~beta1-1ubuntu1",
        "1.0.0~beta2-1",
        "1.0.0~beta2-1ubuntu0.1~esm1",
        "1.0.0~beta2-1ubuntu0.1~esm2"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "composer",
            "binary_version": "1.6.3-1ubuntu0.1~esm2"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:Pro:18.04:LTS",
        "name": "composer",
        "purl": "pkg:deb/ubuntu/composer@1.6.3-1ubuntu0.1~esm2?arch=source\u0026distro=esm-apps/bionic"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "1.5.1-1",
        "1.5.2-1",
        "1.6.2-1",
        "1.6.3-1",
        "1.6.3-1ubuntu0.1~esm1",
        "1.6.3-1ubuntu0.1~esm2"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "composer",
            "binary_version": "1.10.1-1ubuntu0.1~esm2"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:Pro:20.04:LTS",
        "name": "composer",
        "purl": "pkg:deb/ubuntu/composer@1.10.1-1ubuntu0.1~esm2?arch=source\u0026distro=esm-apps/focal"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "1.9.0-2",
        "1.9.1-1",
        "1.9.2-1",
        "1.9.3-1",
        "1.10.0-1",
        "1.10.1-1",
        "1.10.1-1ubuntu0.1~esm1",
        "1.10.1-1ubuntu0.1~esm2"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "composer",
            "binary_version": "2.2.6-2ubuntu4+esm1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:Pro:22.04:LTS",
        "name": "composer",
        "purl": "pkg:deb/ubuntu/composer@2.2.6-2ubuntu4+esm1?arch=source\u0026distro=esm-apps/jammy"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "2.0.9-2ubuntu2",
        "2.0.9-2ubuntu3",
        "2.0.13-1ubuntu1",
        "2.1.12-1ubuntu1",
        "2.2.6-2ubuntu4",
        "2.2.6-2ubuntu4+esm1"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "composer",
            "binary_version": "2.7.1-2ubuntu0.1~esm1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:Pro:24.04:LTS",
        "name": "composer",
        "purl": "pkg:deb/ubuntu/composer@2.7.1-2ubuntu0.1~esm1?arch=source\u0026distro=esm-apps/noble"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "2.5.8-1",
        "2.6.5-1",
        "2.6.6-1",
        "2.7.1-2",
        "2.7.1-2ubuntu0.1~esm1"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "composer",
            "binary_version": "2.8.8-1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:25.10",
        "name": "composer",
        "purl": "pkg:deb/ubuntu/composer@2.8.8-1?arch=source\u0026distro=questing"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "2.8.6-1",
        "2.8.8-1"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "composer",
            "binary_version": "2.9.5-1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:26.04:LTS",
        "name": "composer",
        "purl": "pkg:deb/ubuntu/composer@2.9.5-1?arch=source\u0026distro=resolute"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "2.8.8-1",
        "2.9.5-1"
      ]
    }
  ],
  "aliases": [],
  "details": "Composer is a dependency Manager for the PHP language. Prior to 2.2.29 and 2.10.2, a maliciously crafted package from an untrusted repository other than Packagist.org or Private Packagist can cause Composer to write attacker-controlled files outside the vendor directory and outside the project during install or update by using an invalid package name that is not correctly validated before dependency-resolution results are written or installed. This issue is fixed in versions 2.2.29 and 2.10.2.",
  "id": "UBUNTU-CVE-2026-59948",
  "modified": "2026-07-15T17:53:45Z",
  "published": "2026-07-08T20:16:00Z",
  "references": [
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2026-59948"
    },
    {
      "type": "REPORT",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-59948"
    },
    {
      "type": "REPORT",
      "url": "https://github.com/composer/composer/security/advisories/GHSA-499r-g7pc-vmp9"
    }
  ],
  "related": [],
  "schema_version": "1.7.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    },
    {
      "score": "medium",
      "type": "Ubuntu"
    }
  ],
  "upstream": [
    "CVE-2026-59948"
  ]
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CVE-2026-59948 (GCVE-0-2026-59948)

bit-composer-2026-59948

Vulnerability from bitnami_vulndb

CLEANSTART-2026-UO36556 (CVE-2026-59948)

FKIE_CVE-2026-59948

GHSA-499R-G7PC-VMP9

Summary

Am I affected?

Patched versions

Workarounds

OPENSUSE-SU-2026:11268-1

OPENSUSE-SU-2026:21520-1

SUSE-SU-2026:23116-1

SUSE-SU-2026:23138-1

UBUNTU-CVE-2026-59948 (CVE-2026-59948)

Tags

Sightings

Nomenclature

Related by attack behaviour