DEV Community

CVE Reports
CVE Reports

Posted on • Originally published at cvereports.com

CVE-2026-59948: CVE-2026-59948: Path Traversal and Arbitrary File Write in Composer Dependency Resolution

#security #cve #cybersecurity

CVE-2026-59948: Path Traversal and Arbitrary File Write in Composer Dependency Resolution

Vulnerability ID: CVE-2026-59948
CVSS Score: 7.0
Published: 2026-07-20

CVE-2026-59948 is a high-severity path traversal and arbitrary file write vulnerability in the Composer dependency manager for PHP. When resolving package dependencies from custom, untrusted repositories, vulnerable versions fail to validate critical metadata like package names, source/dist URLs, and binary paths. An attacker who controls a third-party repository can serve a malicious package structure that escapes the 'vendor/' folder, enabling arbitrary file creation, option injection in VCS commands, and potential local execution.

TL;DR

Composer versions prior to 2.2.29 and 2.10.2 do not validate metadata from untrusted repositories during dependency resolution, permitting path traversal, arbitrary file writes outside the project directory, and argument injection.

⚠️ Exploit Status: POC

Technical Details

  • CWE ID: CWE-22 (Path Traversal), CWE-787 (Out-of-bounds Write)
  • Attack Vector: Local (Requires user interaction to run Composer commands)
  • CVSS Score: 7.0 (High)
  • EPSS Score: 0.00132 (Percentile: 3.13%)
  • Impact: Arbitrary File Write, Remote Code Execution (RCE) via path traversal
  • Exploit Status: Proof-of-Concept via unit tests, no active exploitation
  • KEV Status: Not Listed

Affected Systems

  • Composer (PHP Dependency Manager)
  • Composer: >= 1.0, < 2.2.29 (Fixed in: 2.2.29)
  • Composer: >= 2.3.0, < 2.10.2 (Fixed in: 2.10.2)

Code Analysis

Commit: 502c6c4

Add strict validation in LockTransaction using ValidatingArrayLoader on v2.10 line

Commit: c50b1ef

Backport verification gate to v2.2 LTS branch

Mitigation Strategies

  • Upgrade Composer to fixed versions 2.2.29 or 2.10.2
  • Restrict configuration of untrusted third-party repositories
  • Run Composer processes inside low-privilege isolated container environments

Remediation Steps:

  1. Verify the running version of Composer using 'composer --version'
  2. Execute 'composer self-update --stable' to update to the latest patched version
  3. Ensure custom repositories in composer.json are audited and trusted
  4. Implement 'composer audit' in automated CI/CD pipelines

References

Read the full report for CVE-2026-59948 on our website for more details including interactive diagrams and full exploit analysis.

Top comments (0)