Remote Code Execution via web-accessible composer.phar
Priority MEDIUM 43CWE-74Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub.
Summary
Composer is a dependency manager for PHP. Users publishing a composer.phar to a public web-accessible server where the composer.phar can be executed as a php file may be subject to a remote code execution vulnerability if PHP also has `register_argc_argv` enabled in php.ini. Versions 2.6.4, 2.2.22 and 1.10.27 patch this vulnerability. Users are advised to upgrade. Users unable to upgrade should make sure `register_argc_argv` is disabled in php.ini, and avoid publishing composer.phar to the web as this is not best practice.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.01532 74th percentileScored 2026-11-07
Fix Fixed composer (composer): 2.2.22, 1.10.27composer/composer (Packagist): 1.10.27, 2.2.22, 2.6.4
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| composer | composer | 2.6.4, 2.2.21, 1.10.27; 2.0 to before 2.2.22; before 1.10.27 | 2.2.22, 1.10.27 | Patch available | CNA |
| — | composer/composer (Packagist) | before 1.10.27 | 1.10.27 | Patch available | GHSA-jm6m-4632-36hf |
| — | composer/composer (Packagist) | 2.0.0 to before 2.2.22 | 2.2.22 | Patch available | GHSA-jm6m-4632-36hf |
| — | composer/composer (Packagist) | 2.3.0 to before 2.6.4 | 2.6.4 | Patch available | GHSA-jm6m-4632-36hf |
- composer Vendorcomposer Affected 2.6.4, 2.2.21, 1.10.27; 2.0 to before 2.2.22; before 1.10.27 Fixed in 2.2.22, 1.10.27 Patch available CNA
- composer/composer (Packagist) Vendor— Affected before 1.10.27 Fixed in 1.10.27 Patch available GHSA-jm6m-4632-36hf
- composer/composer (Packagist) Vendor— Affected 2.0.0 to before 2.2.22 Fixed in 2.2.22 Patch available GHSA-jm6m-4632-36hf
- composer/composer (Packagist) Vendor— Affected 2.3.0 to before 2.6.4 Fixed in 2.6.4 Patch available GHSA-jm6m-4632-36hf
CPE configurations NVD · 4
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:getcomposer:composer:*:*:*:*:*:*:*:* | before 1.10.27; 2.0.0 to before 2.2.21; 2.3.0 to before 2.6.4 | Vulnerable | composer |
| cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:* | 10.0 | Vulnerable | Debian |
| cpe:2.3:o:fedoraproject:fedora:37:*:*:*:*:*:*:* | 37 | Vulnerable | Fedoraproject |
| cpe:2.3:o:fedoraproject:fedora:38:*:*:*:*:*:*:* | 38 | Vulnerable | Fedoraproject |
- cpe:2.3:a:getcomposer:composer:*:*:*:*:*:*:*:* Versions before 1.10.27; 2.0.0 to before 2.2.21; 2.3.0 to before 2.6.4 Vulnerable ·composer
- cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:* Versions 10.0 Vulnerable ·Debian
- cpe:2.3:o:fedoraproject:fedora:37:*:*:*:*:*:*:* Versions 37 Vulnerable ·Fedoraproject
- cpe:2.3:o:fedoraproject:fedora:38:*:*:*:*:*:*:* Versions 38 Vulnerable ·Fedoraproject
Remediation
- Fix · CNA composer (composer) Fixed in 2.2.22, 1.10.27
- Fix · GHSA-jm6m-4632-36hf composer/composer (Packagist) Fixed in 1.10.27 Advisory →
- Fix · GHSA-jm6m-4632-36hf composer/composer (Packagist) Fixed in 2.2.22 Advisory →
- Fix · GHSA-jm6m-4632-36hf composer/composer (Packagist) Fixed in 2.6.4 Advisory →
Vendor assessments
Timeline
- 2026-10-02 Threatist record created from CVE-2023-43655
- 2026-10-03 Alias added: GHSA-jm6m-4632-36hf
References
Patch 3
Advisory 5
- https://github.com/composer/composer/security/advisories/GHSA-jm6m-4632-36hf
- https://lists.fedoraproject.org/archives/list/[email protected]/message/KFOPGPW2KS37O3KJWBRGTUWHTXCQXBS2/
- https://lists.fedoraproject.org/archives/list/[email protected]/message/7AWYAUZNH565NWPIKGEIYBWHYNM5JGAE/
- https://lists.fedoraproject.org/archives/list/[email protected]/message/66H2WKFUO255T3BZTL72TNYJYH2XM5FG/
- https://nvd.nist.gov/vuln/detail/CVE-2023-43655
Other 5
- https://lists.debian.org/debian-lts-announce/2024/03/msg00030.html
- https://github.com/composer/composer
- https://lists.fedoraproject.org/archives/list/[email protected]/message/66H2WKFUO255T3BZTL72TNYJYH2XM5FG
- https://lists.fedoraproject.org/archives/list/[email protected]/message/7AWYAUZNH565NWPIKGEIYBWHYNM5JGAE
- https://lists.fedoraproject.org/archives/list/[email protected]/message/KFOPGPW2KS37O3KJWBRGTUWHTXCQXBS2
More Composer vulnerabilities
- TI-2015-06892 Composer before 2016-02-10 allows cache poisoning from other projects built on the same… CVSS 3.1HIGH 8.8
- TI-2021-17955 Command injection in composer on Windows CVSS 3.1CRITICAL 9.8
- TI-2021-10185 Code injection in composer CVSS 3.1HIGH 8.8
- TI-2022-08641 Missing input validation can lead to command execution in composer CVSS 3.1HIGH 8.8
- TI-2026-29055 Composer has Command Injection via Malicious Perforce Reference CVSS 3.1HIGH 8.8
- TI-2024-16338 Code execution and possible privilege escalation via compromised InstalledVersions.php or installed.php in Composer CVSS 3.1HIGH 8.8
Sources
- CVE-2023-43655 · CVE Program
- CVE-2023-43655 · NVD
- FIRST EPSS
- GHSA-jm6m-4632-36hf · GitHub Advisory Database · CC BY 4.0
- CVE-2023-43655 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences