Composer before 2016-02-10 allows cache poisoning from other projects built on the same…
Priority HIGH 73CWE-345Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- Required
- Attack complexity
- Low
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub. Impact type from CWE-345.
Summary
Composer before 2016-02-10 allows cache poisoning from other projects built on the same host. This results in attacker-controlled code entering a server-side build process. The issue occurs because of the way that dist packages are cached. The cache key is derived from the package name, the dist type, and certain other data from the package repository (which may simply be a commit hash, and thus can be found by an attacker). Versions through 1.0.0-alpha11 are affected, and 1.0.0 is unaffected.
Why it matters now
Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00723 54th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed composer/composer (Packagist): 1.0.0
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | — | all versions | — | No fix listed | CNA |
| — | composer/composer (Packagist) | before 1.0.0 | 1.0.0 | Patch available | GHSA-725m-w832-q973 |
- — Vendor— Affected all versions Fixed in — No fix listed CNA
- composer/composer (Packagist) Vendor— Affected before 1.0.0 Fixed in 1.0.0 Patch available GHSA-725m-w832-q973
CPE configurations NVD · 11
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:getcomposer:composer:1.0.0:alpha1:*:*:*:*:*:* | 1.0.0 alpha1 | Vulnerable | composer |
| cpe:2.3:a:getcomposer:composer:1.0.0:alpha10:*:*:*:*:*:* | 1.0.0 alpha10 | Vulnerable | composer |
| cpe:2.3:a:getcomposer:composer:1.0.0:alpha11:*:*:*:*:*:* | 1.0.0 alpha11 | Vulnerable | composer |
| cpe:2.3:a:getcomposer:composer:1.0.0:alpha2:*:*:*:*:*:* | 1.0.0 alpha2 | Vulnerable | composer |
| cpe:2.3:a:getcomposer:composer:1.0.0:alpha3:*:*:*:*:*:* | 1.0.0 alpha3 | Vulnerable | composer |
| cpe:2.3:a:getcomposer:composer:1.0.0:alpha4:*:*:*:*:*:* | 1.0.0 alpha4 | Vulnerable | composer |
| cpe:2.3:a:getcomposer:composer:1.0.0:alpha5:*:*:*:*:*:* | 1.0.0 alpha5 | Vulnerable | composer |
| cpe:2.3:a:getcomposer:composer:1.0.0:alpha6:*:*:*:*:*:* | 1.0.0 alpha6 | Vulnerable | composer |
| cpe:2.3:a:getcomposer:composer:1.0.0:alpha7:*:*:*:*:*:* | 1.0.0 alpha7 | Vulnerable | composer |
| cpe:2.3:a:getcomposer:composer:1.0.0:alpha8:*:*:*:*:*:* | 1.0.0 alpha8 | Vulnerable | composer |
- cpe:2.3:a:getcomposer:composer:1.0.0:alpha1:*:*:*:*:*:* Versions 1.0.0 alpha1 Vulnerable ·composer
- cpe:2.3:a:getcomposer:composer:1.0.0:alpha10:*:*:*:*:*:* Versions 1.0.0 alpha10 Vulnerable ·composer
- cpe:2.3:a:getcomposer:composer:1.0.0:alpha11:*:*:*:*:*:* Versions 1.0.0 alpha11 Vulnerable ·composer
- cpe:2.3:a:getcomposer:composer:1.0.0:alpha2:*:*:*:*:*:* Versions 1.0.0 alpha2 Vulnerable ·composer
- cpe:2.3:a:getcomposer:composer:1.0.0:alpha3:*:*:*:*:*:* Versions 1.0.0 alpha3 Vulnerable ·composer
- cpe:2.3:a:getcomposer:composer:1.0.0:alpha4:*:*:*:*:*:* Versions 1.0.0 alpha4 Vulnerable ·composer
- cpe:2.3:a:getcomposer:composer:1.0.0:alpha5:*:*:*:*:*:* Versions 1.0.0 alpha5 Vulnerable ·composer
- cpe:2.3:a:getcomposer:composer:1.0.0:alpha6:*:*:*:*:*:* Versions 1.0.0 alpha6 Vulnerable ·composer
- cpe:2.3:a:getcomposer:composer:1.0.0:alpha7:*:*:*:*:*:* Versions 1.0.0 alpha7 Vulnerable ·composer
- cpe:2.3:a:getcomposer:composer:1.0.0:alpha8:*:*:*:*:*:* Versions 1.0.0 alpha8 Vulnerable ·composer
Remediation
- Fix · GHSA-725m-w832-q973 composer/composer (Packagist) Fixed in 1.0.0 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2015-8371
- 2026-10-03 Alias added: GHSA-725m-w832-q973
References
Exploit 1
Advisory 3
More Composer vulnerabilities
- TI-2021-17955 Command injection in composer on Windows CVSS 3.1CRITICAL 9.8
- TI-2021-10185 Code injection in composer CVSS 3.1HIGH 8.8
- TI-2022-08641 Missing input validation can lead to command execution in composer CVSS 3.1HIGH 8.8
- TI-2026-29055 Composer has Command Injection via Malicious Perforce Reference CVSS 3.1HIGH 8.8
- TI-2023-23380 Remote Code Execution via web-accessible composer.phar CVSS 3.1HIGH 8.8
- TI-2024-16338 Code execution and possible privilege escalation via compromised InstalledVersions.php or installed.php in Composer CVSS 3.1HIGH 8.8
Sources
- CVE-2015-8371 · CVE Program
- CVE-2015-8371 · NVD
- FIRST EPSS
- GHSA-725m-w832-q973 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences