CVE-2026-59944
MediumCVSS 6.1Summary
Composer from 1.0 to 2.2.30 and from 2.3.0 to 2.10.3 allows a malicious or compromised dependency to bypass the earlier binary-path hardening from CVE-2026-59946. Through an in-package symlink or installed.json metadata, an attacker can point to a binary path outside the installation directory, and Composer may change the external file's permissions and create a runnable vendor/bin proxy.
Risk Assessment
This can lead to permission changes on files outside the installation directory and creation of a runnable proxy, potentially enabling further attacks. The issue does not directly provide remote code execution or read data.
Recommendation
Update Composer to version 2.2.30 or 2.10.3 (or later), which contain the fix for this issue.
Other vulnerabilities in Composer
See all- CVE-2026-84361High
Composer, a dependency manager for PHP, has a vulnerability in versions from 1.0 to 2.2.30 and 2.10.3. A malicious package from a custom repository or an untrusted composer.lock file can set source.type to perforce and source.url to a P4PORT value starting with rsh: or jsh:. When the Perforce p4 client is installed and Composer installs the package from source, p4 executes a local command with the privileges of the user or CI account.
- CVE-2026-45793High
A vulnerability in Composer, a dependency manager for PHP, allows disclosure of GitHub OAuth tokens in error logs. Token validation using a regex rejects GITHUB_TOKEN values containing '-', and the rejected token is interpolated into an exception message, leading to leakage to stderr or CI logs.
- CVE-2026-59948High
A vulnerability in the Composer dependency manager for PHP allows an attacker to write files outside the vendor directory and project during package installation or update. The issue occurs when a package from an untrusted repository (other than Packagist.org or Private Packagist) uses an invalid name that is not properly validated before dependency-resolution results are written.
- CVE-2026-59947Medium
Composer, a dependency manager for PHP, prior to versions 2.2.29 and 2.10.2 leaked credentials (e.g., GitHub tokens) to debug output when run with -vvv verbosity. The issue was due to missing sanitization of username-only URL credentials.
- CVE-2026-59946Medium
A vulnerability in the Composer dependency manager for PHP allows changing permissions of an existing host file to world-readable and world-executable. The issue occurs during package install, update, or require when a package bin entry contains '..' path segments.
- CVE-2026-40261High
Composer versions 1.0 through 2.2.26 and 2.3 through 2.9.5 contain a command injection vulnerability in the Perforce::syncCodeBase() and Perforce::generateP4Command() methods. An attacker can inject arbitrary commands through crafted source reference or source url values containing shell metacharacters, even if Perforce is not installed.
- CVE-2026-40176High
Command injection vulnerability in the Perforce::generateP4Command() method in Composer, a dependency manager for PHP. An attacker can inject arbitrary commands through Perforce connection parameters (port, user, client) in a malicious composer.json, leading to command execution in the context of the user running Composer.
Original NVD description (English source)
Composer is a dependency Manager for the PHP language. From 1.0 until 2.2.30 and from 2.3.0 until 2.10.3, a malicious or compromised dependency can bypass the earlier CVE-2026-59946 binary-path hardening because Composer validates literal parent-directory segments only during dependency resolution, while the symlink and installed-metadata paths described by the advisory skip that validation. A package can ship an in-package binary symlink that resolves outside its installation directory, or attacker-influenced vendor/composer/installed.json metadata can provide an escaping binary path during a reinstall or regeneration of missing vendor/bin entries. The installed-metadata path is reachable only when the vendor directory was not populated by the same validated install run, such as when it is restored from an untrusted cache, copied from an earlier build stage, carried over from an older Composer run, or writable by a lower-trust build step. Composer can follow the path, change the external target's permissions to make it world-readable and executable, and create a runnable vendor/bin proxy to that external file. The issue does not directly read or transmit data and does not by itself provide remote code execution. This issue is fixed in versions 2.2.30 and 2.10.3.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS