Composer: Three Vulnerabilities in Package Handling and Credential Leakage Patched
Three vulnerabilities in Composer, disclosed on July 10, 2026, expose risks in package handling and credential security, patched in v2.2.29 and v2.10.2.
Key findings
- Composer 2.2.29 and 2.10.2 fix three disclosed vulnerabilities.
- CVE-2026-59946 allows modification of host file permissions via crafted package bin entries.
- CVE-2026-59948 enables writing attacker-controlled files outside the vendor directory from untrusted sources.
- CVE-2026-59947 can leak embedded credentials in debug output.
On July 10, 2026, three vulnerabilities were disclosed in Composer, a popular dependency manager for the PHP language. These vulnerabilities, all patched in versions 2.2.29 and 2.10.2, collectively highlight risks associated with handling untrusted package sources and the potential for sensitive information leakage.
Two of the vulnerabilities, CVE-2026-59946 and CVE-2026-59948, relate to the Composer package installation process. CVE-2026-59946 details how a Composer package's bin entry, if crafted with specific path segments, could lead to Composer modifying existing host files, changing their permissions to be world-readable and world-executable. This could allow an attacker to escalate privileges or disrupt system operations.
CVE-2026-59948 addresses a more direct file manipulation risk. A maliciously crafted package from an untrusted repository, other than the default Packagist.org or Private Packagist, could trick Composer into writing attacker-controlled files outside the intended vendor directory and project scope during installation or updates. This could lead to arbitrary file write vulnerabilities, potentially allowing for code execution or system compromise.
The third vulnerability, CVE-2026-59947, concerns information disclosure. When Composer is run with the verbose debug flag (-vvv), it could inadvertently print credentials, such as GitHub Personal Access Tokens embedded in repository or package URLs, to the debug output. This could expose sensitive authentication tokens to logs or other monitoring systems, posing a significant security risk if not properly managed.
All three vulnerabilities were addressed in Composer versions 2.2.29 and 2.10.2. Users are strongly advised to update to these patched versions to mitigate the risks associated with untrusted package handling and potential credential exposure. Failure to update could leave PHP projects vulnerable to package manipulation and sensitive data leakage.