Description
Composer is a dependency manager for PHP. Versions 1.0 through 2.2.26 and 2.3 through 2.9.5 contain a command injection vulnerability in the Perforce::generateP4Command() method, which constructs shell commands by interpolating user-supplied Perforce connection parameters (port, user, client) without proper escaping. An attacker can inject arbitrary commands through these values in a malicious composer.json declaring a Perforce VCS repository, leading to command execution in the context of the user running Composer, even if Perforce is not installed. VCS repositories are only loaded from the root composer.json or the composer config directory, so this cannot be exploited through composer.json files of packages installed as dependencies. Users are at risk if they run Composer commands on untrusted projects with attacker-supplied composer.json files. This issue has been fixed in Composer 2.2.27 (2.2 LTS) and 2.9.6 (mainline).
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| composer | composer | >= 2.3, < 2.9.6, >= 1.0, < 2.2.27 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | composer | 2.9.7-1 | — |
| Debian 13 | composer | 2.8.8-1+deb13u2 | — |
| Debian 12 | composer | 2.5.5-1+deb12u4 | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.10 | composer | No fix yet | — |
| Ubuntu 26.04 LTS | composer | No fix yet | — |
| Ubuntu 25.10 | composer | No fix yet | — |
Show 5 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 24.04 LTS | composer | No fix yet | — |
| Ubuntu Pro 22.04 LTS | composer | No fix yet | — |
| Ubuntu Pro 20.04 LTS | composer | No fix yet | — |
| Ubuntu Pro 18.04 LTS | composer | No fix yet | — |
| Ubuntu Pro 16.04 LTS | composer | No fix yet | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Hardened Images 1 | composer | 2.9.7-1.hum1 | RHSA-2026:8165 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 15 SP7 | php-composer2 | 2.6.4-150600.3.12.1 | SUSE-SU-2026:3105-1 |
| SLES 15 SP6 | php-composer2 | 2.6.4-150600.3.12.1 | SUSE-SU-2026:3105-1 |
Show 3 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES for SAP 16.0 | php-composer2 | 2.8.9-160000.4.1 | SUSE-SU-2026:23138-1, SUSE-SU-2026:23116-1 |
| SLES for SAP 15 SP6 | php-composer2 | 2.6.4-150600.3.12.1 | SUSE-SU-2026:3105-1 |
| SLES 16.0 | php-composer2 | 2.8.9-160000.4.1 | SUSE-SU-2026:23138-1, SUSE-SU-2026:23116-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | php-composer2 | 2.9.7-1.1 | openSUSE-SU-2026:10643-1 |
| openSUSE Leap 16.0 | php-composer2 | 2.8.9-160000.4.1 | openSUSE-SU-2026:21520-1 |
Alpine
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.24 | composer | 2.9.6-r0 | — |
| Alpine v3.23 | composer | 2.9.6-r0 | — |
Amazon Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Amazon Linux 2023 | composer | 2.9.7-1.amzn2023.0.1 | ALAS2023-2026-1625 |
Wolfi
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Wolfi rolling | composer | 2.9.7-r0 | — |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
GitHub 3 repositories
-
Saku0512/CVE-2026-40176-poc ★ 2 · Apr 16, 2026
-
ikarolaborda/CVE-2026-40176 ★ 0 · Jun 15, 2026
-
daptheHuman/cve-2026-40176-cve-2026-40261 ★ 0 · Apr 17, 2026
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Packagist | composer/composer | >= 2.3.0, < 2.9.6 | 2.9.6 | GHSA-wg36-wvj6-r67p |
| Packagist | composer/composer | >= 1.0.0, < 2.2.27 | 2.2.27 | GHSA-wg36-wvj6-r67p |
Advisories 8
- RHSA-2026:8165 Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update Red Hat Security Advisories (RHSA) · Oct 6, 2026
- WID-SEC-2026-1128 Composer: Mehrere Schwachstellen ermöglichen Codeausführung BSI CERT-Bund (WID) · Aug 16, 2026
- SUSE-SU-2026:23138-1 Security update for php-composer2 SUSE / openSUSE Security Updates · Aug 14, 2026
- SUSE-SU-2026:23116-1 Security update for php-composer2 SUSE / openSUSE Security Updates · Aug 14, 2026
- openSUSE-SU-2026:21520-1 Security update for php-composer2 SUSE / openSUSE Security Updates · Aug 4, 2026
- SUSE-SU-2026:3105-1 Security update for php-composer2 SUSE / openSUSE Security Updates · Jul 18, 2026
- ALAS2023-2026-1625 Important: composer security update (Amazon Linux 2023) Amazon Linux Security Center (ALAS) · Apr 30, 2026
- openSUSE-SU-2026:10643-1 php-composer2-2.9.7-1.1 on GA media SUSE / openSUSE Security Updates · Apr 29, 2026
References
- https://github.com/composer/composer/security/advisories/GHSA-wg36-wvj6-r67p
- https://access.redhat.com/errata/RHSA-2026:8165
- https://access.redhat.com/security/cve/CVE-2026-40176
- https://bugzilla.redhat.com/show_bug.cgi?id=2458828
- https://github.com/FriendsOfPHP/security-advisories/blob/master/composer/composer/CVE-2026-40176.yaml
- https://github.com/composer/composer/releases/tag/2.2.27
- https://github.com/composer/composer/releases/tag/2.9.6
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-40176.json