High severityNVD Advisory· Published Sep 29, 2023· Updated Jun 18, 2025
Remote Code Execution via web-accessible composer.phar
CVE-2023-43655
Description
Composer is a dependency manager for PHP. Users publishing a composer.phar to a public web-accessible server where the composer.phar can be executed as a php file may be subject to a remote code execution vulnerability if PHP also has register_argc_argv enabled in php.ini. Versions 2.6.4, 2.2.22 and 1.10.27 patch this vulnerability. Users are advised to upgrade. Users unable to upgrade should make sure register_argc_argv is disabled in php.ini, and avoid publishing composer.phar to the web as this is not best practice.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
composer/composerPackagist | < 1.10.27 | 1.10.27 |
composer/composerPackagist | >= 2.0.0, < 2.2.22 | 2.2.22 |
composer/composerPackagist | >= 2.3.0, < 2.6.4 | 2.6.4 |
Affected products
8- osv-coords7 versionspkg:bitnami/composerpkg:composer/composer/composerpkg:rpm/opensuse/php-composer2&distro=openSUSE%20Leap%2015.4pkg:rpm/opensuse/php-composer2&distro=openSUSE%20Leap%2015.5pkg:rpm/opensuse/php-composer2&distro=openSUSE%20Tumbleweedpkg:rpm/suse/php-composer2&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Web%20and%20Scripting%2015%20SP4pkg:rpm/suse/php-composer2&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Web%20and%20Scripting%2015%20SP5
< 1.10.27+ 6 more
- (no CPE)range: < 1.10.27
- (no CPE)range: < 1.10.27
- (no CPE)range: < 2.2.3-150400.3.6.1
- (no CPE)range: < 2.2.3-150400.3.6.1
- (no CPE)range: < 2.6.4-1.1
- (no CPE)range: < 2.2.3-150400.3.6.1
- (no CPE)range: < 2.2.3-150400.3.6.1
Patches
Vulnerability mechanics
References
13- github.com/advisories/GHSA-jm6m-4632-36hfghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2023-43655ghsaADVISORY
- github.com/composer/composer/commit/4fce14795aba98e40b6c4f5047305aba17a6120dghsax_refsource_MISCWEB
- github.com/composer/composer/commit/955a48e6319c8962e5cd421b07c00ab3c728968cghsax_refsource_MISCWEB
- github.com/composer/composer/commit/95e091c921037b7b6564942845e7b738f6b95c9cghsax_refsource_MISCWEB
- github.com/composer/composer/security/advisories/GHSA-jm6m-4632-36hfghsax_refsource_CONFIRMWEB
- lists.debian.org/debian-lts-announce/2024/03/msg00030.htmlghsaWEB
- lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/66H2WKFUO255T3BZTL72TNYJYH2XM5FGghsaWEB
- lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/7AWYAUZNH565NWPIKGEIYBWHYNM5JGAEghsaWEB
- lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KFOPGPW2KS37O3KJWBRGTUWHTXCQXBS2ghsaWEB
- lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/66H2WKFUO255T3BZTL72TNYJYH2XM5FG/mitre
- lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/7AWYAUZNH565NWPIKGEIYBWHYNM5JGAE/mitre
- lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KFOPGPW2KS37O3KJWBRGTUWHTXCQXBS2/mitre
News mentions
0No linked articles in our index yet.