CVE-2026-59946: Composer Path Traversal Vulnerability – File Permission Escalation

Technical summary

The vulnerability exploits insufficient validation of bin entry paths in Composer's package installation mechanism. When Composer processes bin directives during installation, it resolves symlinks and applies chmod operations without properly constraining paths to the package install directory. A package maintainer can embed path traversal sequences (..) in bin entry definitions, causing Composer to chmod arbitrary files on the host system to mode 0777 (read, write, execute for all users). The issue affects Composer versions prior to 2.2.29 and 2.10.2. The attack requires user interaction (running composer install/update/require) but leverages the implicit trust users place in composer commands and package metadata.

Business impact

Organizations relying on Composer for PHP dependency management face two distinct risks. First, supply-chain compromise: attackers maintaining or gaining control of published packages can inject malicious bin entries to alter permissions on sensitive files, enabling lateral movement or data theft. Second, operational risk: developers using Composer in shared environments or CI/CD pipelines may inadvertently execute composer commands that modify system files, weakening host security posture. The impact scales with the number of developers and automation systems running Composer, and the sensitivity of files accessible in their runtime contexts.

Affected systems

Composer versions prior to 2.2.29 (2.2.x branch) and 2.10.2 (2.10.x and earlier 2.x versions) are affected. Any system running an affected version that executes composer install, composer update, or composer require commands is at risk. This includes developer workstations, CI/CD runners, containerized build environments, and production systems that use Composer for deployment. PHP applications and their dependency chains are the primary exposure vector.

Exploitability

Exploitability requires two conditions: (1) a user or system must run a Composer command that processes packages (install, update, or require), and (2) the malicious package with crafted bin entries must be pulled from a repository during that operation. Attack surface is broadest in development environments and CI/CD pipelines where Composer runs frequently. The vulnerability is not remotely exploitable without user action; it does not execute arbitrary code but does modify file permissions, which can enable subsequent attacks. CVSS 6.1 (MEDIUM) reflects the local attack vector, user interaction requirement, and the limited impact of permission modification alone—though the contextual damage depends on which files are targeted.

Remediation

Upgrade Composer to version 2.2.29 or later (for 2.2.x users) or version 2.10.2 or later (for 2.10.x users). Verify the installed version using composer --version. No configuration workarounds are available; patching is the definitive fix. For organizations unable to patch immediately, restrict package sources to trusted, internal repositories and audit package.json files for suspicious bin entries before running Composer commands in production or shared environments.

Patch guidance

Update Composer using the standard installation method for your environment. If you installed Composer globally via the installer, run: php composer-setup.php (or use your package manager, e.g., brew upgrade composer on macOS). If using Docker, ensure your image builds pull the latest Composer version or explicitly pin to 2.2.29 or 2.10.2 or later. Verify the upgrade with composer --version. Check vendor advisories from your hosting provider or package repository if you use managed Composer environments. Test the upgrade in a non-production environment first to ensure no compatibility regressions with your existing projects.

Detection guidance

Monitor Composer version usage across your development and CI/CD infrastructure. Audit package.json and composer.lock files for suspicious bin entries that contain .. or other path traversal patterns (tools like grep or SAST can assist). Review system file permission changes on machines running Composer, particularly unexpected chmod operations on sensitive files in /usr/bin, /usr/local/bin, or configuration directories. Check CI/CD logs for Composer command execution and cross-reference with package versions from the time of file modifications. Implement process monitoring to alert on chmod operations initiated by Composer or its child processes.

Why prioritize this

While CVSS 6.1 is moderate, this vulnerability warrants prioritization because: (1) Composer is ubiquitous in PHP development; (2) attack surface spans both development and CI/CD, multiplying exposure; (3) the attack is supply-chain-oriented, meaning a single compromised or malicious package affects all consumers; (4) permission modification can enable privilege escalation or data exfiltration downstream. Organizations with large PHP codebases or those pulling packages from untrusted sources should prioritize patching.

Risk score, explained

CVSS 6.1 reflects: Attack Vector Local (user must run Composer on affected system); Attack Complexity Low (no special conditions beyond crafted package metadata); Privileges Required None; User Interaction Required (composer command execution); Scope Unchanged (impact limited to local system); Confidentiality High (world-readable files exposed); Integrity Low (permissions modified, not file content directly); Availability None. The score does not capture supply-chain amplification or contextual damage from specific compromised files, but is appropriate for the base technical risk.

Frequently asked questions