Skip to content
Sign in
7.0 High

CVE-2026-59948 Composer is a dependency Manager for the PHP language

Description

Composer is a dependency Manager for the PHP language. Prior to 2.2.29 and 2.10.2, a maliciously crafted package from an untrusted repository other than Packagist.org or Private Packagist can cause Composer to write attacker-controlled files outside the vendor directory and outside the project during install or update by using an invalid package name that is not correctly validated before dependency-resolution results are written or installed. This issue is fixed in versions 2.2.29 and 2.10.2.

Affected products and versions

Product Affected versions Fixed in
composer 2.3 2.3.0 → < 2.10.2 2.10.2
composer 1.0 1.0 → < 2.2.29 2.2.29

Other CVEs of composer

The 16 CVEs of composer →
CVE-2026-59944 Composer is a dependency Manager for the PHP language 6.1 Medium CVE-2026-84361 Composer is a dependency Manager for the PHP language 7.7 High CVE-2026-45793 Composer is a dependency Manager for the PHP language 7.5 High CVE-2026-59947 Composer is a dependency Manager for the PHP language 4.7 Medium
Track this CVE