Composer: Arbitrary file write outside vendor via malicious transitive package name
Key facts
- Attack vector
- Local
- Privileges required
- None
- User interaction
- Required
- Attack complexity
- High
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-787 and the CVSS impact.
Summary
Composer is a dependency Manager for the PHP language. Prior to 2.2.29 and 2.10.2, a maliciously crafted package from an untrusted repository other than Packagist.org or Private Packagist can cause Composer to write attacker-controlled files outside the vendor directory and outside the project during install or update by using an invalid package name that is not correctly validated before dependency-resolution results are written or installed. This issue is fixed in versions 2.2.29 and 2.10.2.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| composer | composer | 1.0 to before 2.2.29; 2.3.0 to before 2.10.2 | 2.2.29, 2.10.2 | Patch available | CNA |
| — | composer/composer (Packagist) | 2.3.0 to before 2.10.2 | 2.10.2 | Patch available | GHSA-499r-g7pc-vmp9 |
| — | composer/composer (Packagist) | 1.0.0 to before 2.2.29 | 2.2.29 | Patch available | GHSA-499r-g7pc-vmp9 |
- composer Vendorcomposer Affected 1.0 to before 2.2.29; 2.3.0 to before 2.10.2 Fixed in 2.2.29, 2.10.2 Patch available CNA
- composer/composer (Packagist) Vendor— Affected 2.3.0 to before 2.10.2 Fixed in 2.10.2 Patch available GHSA-499r-g7pc-vmp9
- composer/composer (Packagist) Vendor— Affected 1.0.0 to before 2.2.29 Fixed in 2.2.29 Patch available GHSA-499r-g7pc-vmp9
Remediation
- Fix · CNA composer (composer) Fixed in 2.2.29, 2.10.2
- Fix · GHSA-499r-g7pc-vmp9 composer/composer (Packagist) Fixed in 2.10.2 Advisory →
- Fix · GHSA-499r-g7pc-vmp9 composer/composer (Packagist) Fixed in 2.2.29 Advisory →
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
Not affected: 1 product
- Red Hat Hardened Images
Timeline
- 2026-10-02 Threatist record created from CVE-2026-59948
- 2026-10-03 Alias added: GHSA-499r-g7pc-vmp9
References
Other 6
- https://github.com/composer/composer/security/advisories/GHSA-499r-g7pc-vmp9
- https://github.com/composer/composer/commit/502c6c4f699802d9cf464728b3e8a95674f919a0
- https://github.com/composer/composer/commit/c50b1efd13ebd73f6dca19b31424c5a02bf93cc1
- https://github.com/composer/composer/releases/tag/2.10.2
- https://github.com/composer/composer/releases/tag/2.2.29
- https://github.com/composer/composer
More composer vulnerabilities
- TI-2015-06892 Composer before 2016-02-10 allows cache poisoning from other projects built on the same… CVSS 3.1HIGH 8.8
- TI-2021-17955 Command injection in composer on Windows CVSS 3.1CRITICAL 9.8
- TI-2024-23311 Composer vulnerable to command injection via malicious git/hg branch names CVSS 3.1HIGH 8.8
- TI-2021-10185 Code injection in composer CVSS 3.1HIGH 8.8
- TI-2022-08641 Missing input validation can lead to command execution in composer CVSS 3.1HIGH 8.8
- TI-2026-29055 Composer has Command Injection via Malicious Perforce Reference CVSS 3.1HIGH 8.8
Sources
- CVE-2026-59948 · CVE Program
- CVE-2026-59948 · NVD
- FIRST EPSS
- GHSA-499r-g7pc-vmp9 · GitHub Advisory Database · CC BY 4.0
- CVE-2026-59948 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences