Skip to content
OpenAdvisories
Medium WID-SEC-2026-2235 3 CVEs

Composer: Mehrere Schwachstellen

Published Jul 7, 2026 · Updated Oct 8, 2026 · Revision 8 · de-DE

Vendor: SUSE Product: Linux Platform: Linux Platform: Windows

Summary

Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Composer ausnutzen, um Sicherheitsmechanismen zu umgehen, um beliebige Dateien zu schreiben oder um Informationen offenzulegen. Zur erfolgreichen Ausnutzung sind teilweise bestimmte Konfigurationen erforderlich.

Product

Composer ist ein Open-Source-Abhängigkeitsmanager für PHP-Projekte.

Vulnerabilities 3

  • High 7.0
    CVE-2026-59948

    Composer: Arbitrary file write outside vendor via malicious transitive package name

    Composer is a dependency Manager for the PHP language. Prior to 2.2.29 and 2.10.2, a maliciously crafted package from an untrusted repository other than Packagist.org or Private Packagist can cause Composer to write attacker-controlled files outside the vendo…

    composer composer composer/composer composer Debian Ubuntu Packagist
  • Medium 6.1
    CVE-2026-59946

    Composer: Path traversal in package bin field lets dependencies chmod arbitrary host files

    Composer is a dependency Manager for the PHP language. Prior to 2.2.29 and 2.10.2, a Composer package bin entry containing .. path segments can resolve outside the package install directory and cause Composer's binary installation flow to chmod an existing ho…

    composer composer composer/composer composer Debian Ubuntu Packagist
  • Medium 4.7
    CVE-2026-59947

    Composer: URL-embedded HTTP-Basic username leaks to verbose logs (GitHub PAT exposure)

    Composer is a dependency Manager for the PHP language. Prior to 2.2.29 and 2.10.2, when Composer is run with -vvv debug verbosity, it could print a credential embedded in the username slot of a repository or package URL, such as a GitHub Personal Access Token…

    composer composer composer/composer composer Debian Ubuntu Packagist

Revision history

  1. #8

    Neue Updates von SUSE aufgenommen

  2. #7

    Neue Updates von SUSE aufgenommen

  3. #6

    Neue Updates von SUSE aufgenommen

  4. #5

    Referenz(en) aufgenommen: EUVD-2026-80863

  5. #4

    Neue Updates von SUSE aufgenommen

  6. #3

    Neue Updates von SUSE aufgenommen

  7. #2

    Referenz(en) aufgenommen: EUVD-2026-42363, EUVD-2026-42362, EUVD-2026-42360

  8. #1

    Initiale Fassung

References