VYPR
← All advisories
High severityNVD Advisory· Published Sep 29, 2023· Updated Jun 18, 2025

Remote Code Execution via web-accessible composer.phar

CVE-2023-43655

Description

Composer is a dependency manager for PHP. Users publishing a composer.phar to a public web-accessible server where the composer.phar can be executed as a php file may be subject to a remote code execution vulnerability if PHP also has register_argc_argv enabled in php.ini. Versions 2.6.4, 2.2.22 and 1.10.27 patch this vulnerability. Users are advised to upgrade. Users unable to upgrade should make sure register_argc_argv is disabled in php.ini, and avoid publishing composer.phar to the web as this is not best practice.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
composer/composerPackagist
< 1.10.271.10.27
composer/composerPackagist
>= 2.0.0, < 2.2.222.2.22
composer/composerPackagist
>= 2.3.0, < 2.6.42.6.4

Affected products

1

Patches

3
95e091c92103

Merge pull request from GHSA-jm6m-4632-36hf

https://github.com/composer/composerJordi BoggianoSep 29, 2023via ghsa
commit
1 file changed · +5 −0
  • bin/composer+5 −0 modified
    @@ -2,6 +2,11 @@
 <?php
 
 if (PHP_SAPI !== 'cli' && PHP_SAPI !== 'phpdbg') {
+    if (0 === strpos(__FILE__, 'phar:') && ini_get('register_argc_argv')) {
+        echo 'Composer cannot be run safely on non-CLI SAPIs with register_argc_argv=On. Aborting.'.PHP_EOL;
+        exit(1);
+    }
+
     echo 'Warning: Composer should be invoked via the CLI version of PHP, not the '.PHP_SAPI.' SAPI'.PHP_EOL;
 }
955a48e6319c

Merge pull request from GHSA-jm6m-4632-36hf

https://github.com/composer/composerJordi BoggianoSep 29, 2023via ghsa
commit
1 file changed · +5 −0
  • bin/composer+5 −0 modified
    @@ -2,6 +2,11 @@
 <?php
 
 if (PHP_SAPI !== 'cli' && PHP_SAPI !== 'phpdbg') {
+    if (0 === strpos(__FILE__, 'phar:') && ini_get('register_argc_argv')) {
+        echo 'Composer cannot be run safely on non-CLI SAPIs with register_argc_argv=On. Aborting.'.PHP_EOL;
+        exit(1);
+    }
+
     echo 'Warning: Composer should be invoked via the CLI version of PHP, not the '.PHP_SAPI.' SAPI'.PHP_EOL;
 }
4fce14795aba

Merge pull request from GHSA-jm6m-4632-36hf

https://github.com/composer/composerJordi BoggianoSep 29, 2023via ghsa
commit
1 file changed · +5 −0
  • bin/composer+5 −0 modified
    @@ -2,6 +2,11 @@
 <?php
 
 if (PHP_SAPI !== 'cli' && PHP_SAPI !== 'phpdbg') {
+    if (0 === strpos(__FILE__, 'phar:') && ini_get('register_argc_argv')) {
+        echo 'Composer cannot be run safely on non-CLI SAPIs with register_argc_argv=On. Aborting.'.PHP_EOL;
+        exit(1);
+    }
+
     echo 'Warning: Composer should be invoked via the CLI version of PHP, not the '.PHP_SAPI.' SAPI'.PHP_EOL;
 }

Vulnerability mechanics

Generated by null/stub on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

13

News mentions

0

No linked articles in our index yet.