A recent discovery has unveiled a security flaw in Composer, the popular PHP dependency manager, that could enable malicious packages to alter file permissions outside their installation directories.
Details of the Composer Flaw
The vulnerability, identified as CVE-2026-59944, poses a risk to shared or multi-tenant systems by potentially exposing sensitive files when Composer processes package binary paths unsafely. Affecting versions from 2.3.0 to before 2.10.3 and 1.0 to before 2.2.30, this flaw has been assigned a moderate severity rating.
Composer has remedied this issue in versions 2.10.3 and 2.2.30. The problem arises from a path traversal and symbolic-link handling weakness in Composer’s management of package binaries.
Exploitation and Impact
Malicious packages can declare binary files as symbolic links to targets outside their directories. During installation, Composer might follow these links, altering permissions and registering the files as commands in the vendor/bin directory. Although direct remote code execution is not possible, the permission changes can render previously restricted files world-readable and executable.
On platforms like shared hosting, multi-user servers, or build environments, this could allow unauthorized access to exposed content by other users or processes.
Mitigation and Recommendations
This vulnerability circumvents protections from a prior Composer advisory, GHSA-gjfg-22fp-rrxx, which blocked literal “..” path segments but only at one resolution stage. The risk escalates when organizations reuse vendor directories from untrusted sources, as seen in shared CI caches or older builds.
Composer now ensures all declared binaries remain within the package directory, skipping those that do not and issuing warnings. Developers and administrators are urged to upgrade to Composer 2.10.3 or 2.2.30 and rebuild vendor directories from trusted sources, especially in CI/CD pipelines and deployment systems.
The flaw is linked to CWE-22 path traversal, CWE-59 improper link resolution, and CWE-732 incorrect permission assignment. While the CVSS vector suggests low attack complexity, exploitation requires local execution and user interaction.
In conclusion, immediate updates to the latest Composer versions are crucial to secure systems and prevent potential data exposure. Rebuilding from trusted sources further mitigates risks.
