CVE-2026-59948: Composer Path Traversal Vulnerability – File Write Outside Vendor Directory

Technical summary

CVE-2026-59948 is a path traversal vulnerability (CWE-22) combined with improper input validation (CWE-787) in Composer's dependency resolution and installation workflow. The root cause is insufficient validation of package names before dependency-resolution data is written to disk or installed. When Composer processes a maliciously crafted package name from an untrusted repository, the validation logic fails to reject invalid characters or path-traversal sequences. This allows an attacker to specify output paths using traversal patterns (such as '../') that escape the vendor directory and write files to arbitrary locations on the filesystem. The vulnerability exists in the package name handling before files are materialized on disk, making it exploitable during both install and update operations. Packagist.org and Private Packagist implement additional validation and are not vulnerable.

Business impact

For development teams using Composer, this vulnerability poses a direct supply-chain risk. An attacker controlling or injecting a malicious package into a third-party repository could compromise the integrity of any project that installs dependencies from that source. Potential impacts include: unauthorized modification of application code, injection of backdoors or credential-theft logic, corruption of system configurations, and disruption of the development environment. Organizations relying on internal or alternative package repositories face elevated risk. The requirement for user interaction (explicit install/update) provides some protection, but in CI/CD pipelines or automated dependency updates, the barrier to exploitation is low. Remediation requires prompt patching across all development infrastructure.

Affected systems

Composer versions prior to 2.2.29 (stable branch) and 2.10.2 (development branch) are affected. The vulnerability is triggered only when installing or updating packages from repositories other than Packagist.org or Private Packagist. Organizations using alternative or private package repositories, including self-hosted Composer repositories, are at direct risk. The vulnerability does not affect projects that exclusively use official Packagist repositories, though many organizations use mixed repository configurations for proprietary code.

Exploitability

Exploitation requires an attacker to control or compromise a third-party package repository from which a target uses Composer. The attacker must craft a package with an invalid name containing path-traversal sequences and publish it to that repository. When a developer or CI/CD system runs 'composer install' or 'composer update' and includes that malicious package as a dependency, the payload executes. The CVSS vector (AV:L/AC:H/PR:N/UI:R) reflects that this is a local attack requiring user interaction and moderately complex conditions, but the access vector and code execution potential justify a HIGH severity rating. While not trivially exploitable, targeted attacks against development teams or open-source projects using alternative repositories are realistic.

Remediation

Upgrade Composer immediately to version 2.2.29 or later (for the 2.2.x branch) or version 2.10.2 or later (for the 2.10.x branch). Verify against the official Composer release notes to confirm the exact patch version available for your deployment. After patching, audit your composer.json and composer.lock files for any unfamiliar packages, especially from non-Packagist repositories. Consider reviewing recent dependency installation history in logs. If you suspect exposure, regenerate any credentials or secrets that may have been present in the development environment during the vulnerable period.

Patch guidance

Patch availability: Composer 2.2.29 and 2.10.2 address this issue. Update using your package manager (e.g., 'composer self-update' or via Homebrew/apt for system-wide installations). Verify the update completes successfully and confirm the new version with 'composer --version'. For organizations managing Composer across multiple developers or CI/CD systems, centralize the update: update Docker images, CI/CD agent base images, and development machine configurations. Test in a staging environment first to catch any compatibility issues with existing projects. No breaking changes are expected; these are security-focused point releases.

Detection guidance

Monitor for exploitation by auditing recent Composer installation logs for package names containing unusual characters, path-traversal sequences (../, ..), or names that do not match expected package naming conventions (vendor/package format). Check filesystem modification times on files outside the vendor directory around the time of package installs, especially in parent directories of project roots. In CI/CD systems, alert on unexpected file writes outside designated directories during dependency resolution. Review composer.lock files for entries from non-standard repositories, and cross-reference with your organization's approved repository list. If using centralized logging, parse Composer output for validation warnings or errors that may indicate malicious package attempts.

Why prioritize this

This vulnerability merits HIGH priority because it enables arbitrary file write access to a developer's system via a common, integral tool. While the attack requires compromising or controlling an alternative package repository and user action, the consequences are severe: code injection, supply-chain compromise, and full system access from a single malicious package. Development environments often contain secrets, credentials, and source code of high value. The widespread adoption of Composer and reliance on third-party repositories amplifies the risk. The fix is stable and straightforward, making immediate patching the top priority.

Risk score, explained

The CVSS 3.1 score of 7.0 (HIGH) reflects a vulnerability with high integrity and confidentiality impact (an attacker can modify and read files), combined with a local attack vector and user interaction requirement. The attack complexity is high because the attacker must control an alternative repository and engineer a malicious package. However, the scope is unchanged (local system only, no impact on other users), and the severity is not CRITICAL because the vulnerability does not grant unauthenticated remote code execution without user interaction. In the context of supply-chain attacks and development-environment compromise, the practical risk is substantial, and the score appropriately signals urgent patching.

Frequently asked questions