Skip to content
OpenAdvisories
High WID-SEC-2026-1128 2 CVEs

Composer: Mehrere Schwachstellen ermöglichen Codeausführung

Published Apr 14, 2026 · Updated Aug 16, 2026 · Revision 6 · de-DE

Vendor: SUSE Product: Linux

Summary

Ein Angreifer kann mehrere Schwachstellen in Composer ausnutzen, um beliebigen Programmcode auszuführen.

Product

Composer ist ein Open-Source-Abhängigkeitsmanager für PHP-Projekte.

Vulnerabilities 2

  • High 8.8
    CVE-2026-40261 Public exploit

    Composer has Command Injection via Malicious Perforce Reference

    Composer is a dependency manager for PHP. Versions 1.0 through 2.2.26 and 2.3 through 2.9.5 contain a command injection vulnerability in the Perforce::syncCodeBase() method, which appends the $sourceReference parameter to a shell command without proper escapi…

    composer composer composer/composer composer Debian Ubuntu Alpine Wolfi Packagist
  • High 7.8
    CVE-2026-40176 Public exploit

    Composer is vulnerable to Command Injection via Malicious Perforce Repository

    Composer is a dependency manager for PHP. Versions 1.0 through 2.2.26 and 2.3 through 2.9.5 contain a command injection vulnerability in the Perforce::generateP4Command() method, which constructs shell commands by interpolating user-supplied Perforce connecti…

    composer composer composer/composer composer Debian Ubuntu Alpine Wolfi Packagist

Revision history

  1. #6

    Neue Updates von SUSE aufgenommen

  2. #5

    Neue Updates von SUSE aufgenommen

  3. #4

    Neue Updates von SUSE aufgenommen

  4. #3

    Neue Updates von SUSE aufgenommen

  5. #2

    Referenz(en) aufgenommen: EUVD-2026-23118, EUVD-2026-23119

  6. #1

    Initiale Fassung

References