Aller au contenu
en Se connecter
7.0 Élevée

CVE-2026-59948 Composer is a dependency Manager for the PHP language

Description

Composer is a dependency Manager for the PHP language. Prior to 2.2.29 and 2.10.2, a maliciously crafted package from an untrusted repository other than Packagist.org or Private Packagist can cause Composer to write attacker-controlled files outside the vendor directory and outside the project during install or update by using an invalid package name that is not correctly validated before dependency-resolution results are written or installed. This issue is fixed in versions 2.2.29 and 2.10.2.

Produits et versions touchés

Produit Versions touchées Corrigé en
composer 2.3 2.3.0 → < 2.10.2 2.10.2
composer 1.0 1.0 → < 2.2.29 2.2.29

Références

Chronologie

  1. Publiée
  2. Dernière modification

Autres CVE de composer

Les 16 CVE de composer →
CVE-2026-59944 Composer is a dependency Manager for the PHP language 6.1 Moyenne CVE-2026-84361 Composer is a dependency Manager for the PHP language 7.7 Élevée CVE-2026-45793 Composer is a dependency Manager for the PHP language 7.5 Élevée CVE-2026-59947 Composer is a dependency Manager for the PHP language 4.7 Moyenne
Suivre cette CVE