Skip to content
fr Sign in
6.4 Medium

CVE-2023-43655 Composer is a dependency manager for PHP

Description

Composer is a dependency manager for PHP. Users publishing a composer.phar to a public web-accessible server where the composer.phar can be executed as a php file may be subject to a remote code execution vulnerability if PHP also has `register_argc_argv` enabled in php.ini. Versions 2.6.4, 2.2.22 and 1.10.27 patch this vulnerability. Users are advised to upgrade. Users unable to upgrade should make sure `register_argc_argv` is disabled in php.ini, and avoid publishing composer.phar to the web as this is not best practice.

Affected products and versions

Product Affected versions Fixed in
composer 2.0 2.0 → < 2.2.22 2.2.22
composer 1.10 earliest → < 1.10.27 1.10.27
composer 2.6 earliest → 2.6.4 No fix stated

References

Timeline

  1. Published
  2. Last modified

Other CVEs of composer

The 16 CVEs of composer →
CVE-2026-59944 Composer is a dependency Manager for the PHP language 6.1 Medium CVE-2026-84361 Composer is a dependency Manager for the PHP language 7.7 High CVE-2026-45793 Composer is a dependency Manager for the PHP language 7.5 High CVE-2026-59947 Composer is a dependency Manager for the PHP language 4.7 Medium
Track this CVE