CVE catalog

CVE-2026-59948

Composer is a dependency Manager for the PHP language. Prior to 2.2.29 and 2.10.2, a maliciously crafted package from an untrusted repository other than Packagist.org or Private Packagist can cause Co

[CVE catalog]

Severity
High · CVSS 7CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Published
Source
[NVD] · [CVE record]
EPSS
0.14% · Oct 25, 2026

Composer is a dependency Manager for the PHP language. Prior to 2.2.29 and 2.10.2, a maliciously crafted package from an untrusted repository other than Packagist.org or Private Packagist can cause Composer to write attacker-controlled files outside the vendor directory and outside the project during install or update by using an invalid package name that is not correctly validated before dependency-resolution results are written or installed. This issue is fixed in versions 2.2.29 and 2.10.2.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debiancomposersid2.10.3-1fixed
Debiancomposerforky2.10.3-1fixed
Debiancomposertrixie2.8.8-1+deb13u3vulnerable
Debiancomposerbookworm2.5.5-1+deb12u5vulnerable
Debiancomposerbookworm-security2.5.5-1+deb12u2vulnerable
CpecomposerNot reportedNot reportedvulnerable
Composercomposer/composerNot reported2.10.2fixed
Composercomposer/composerNot reported2.2.29fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debiancomposersourcesid2.10.2-1not yet assignedNot reportedNot reported
Debiancomposersourceforky2.10.2-1not yet assignedNot reportedNot reported
Debiancomposersourcetrixie(unfixed)not yet assignedNot reportedNot reported
Debiancomposersourcebookworm(unfixed)not yet assignedNot reportedNot reported
Composercomposer/composercomposerNot reported2.10.2Not reportedNot reportedNot reported
Composercomposer/composercomposerNot reported2.2.29Not reportedNot reportedNot reported

Notes

[trixie] composer: Minor issue

OpenFactory catalog packages

[Debian 12 (Bookworm)]

  • [composer]Affected
    Details (4)

    • 2.5.5-1+deb12u5 · all · bookworm

      Affected

      nvd · composer · debian · bookworm; nvd · composer · debian · 12

    • 2.5.5-1+deb12u5 · all · bookworm

      Affected

      nvd · composer · debian · bookworm; nvd · composer · debian · 12

    • 2.5.5-1+deb12u2 · all · bookworm-security

      Affected

      nvd · composer · debian · bookworm; nvd · composer · debian · 12

    • 2.5.5-1+deb12u2 · all · bookworm-security

      Affected

      nvd · composer · debian · bookworm; nvd · composer · debian · 12

[Debian 13 (Trixie)]

  • [composer]Affected
    Details (2)

    • 2.8.8-1+deb13u3 · all · trixie

      Affected

      nvd · composer · debian · 13

    • 2.8.8-1+deb13u3 · all · trixie

      Affected

      nvd · composer · debian · 13

Observed:

References

[CERT-Bund public advisories] · [Debian Security Tracker] · [FIRST EPSS] · [GitHub Advisory Database] · [National Vulnerability Database (NVD)] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX]