Composer Vulnerability Allows Malicious Dependencies to Expose Sensitive Files
A flaw in the PHP dependency manager Composer, CVE-2026-59944, enables malicious packages to alter file permissions, potentially exposing sensitive data like SSH keys on shared systems.
A significant security vulnerability has been identified in Composer, the ubiquitous dependency manager for PHP projects, potentially exposing sensitive files on shared or multi-tenant environments. Tracked as CVE-2026-59944, the flaw allows a malicious or compromised package to manipulate file permissions outside of its own installation directory. This could lead to sensitive information, such as SSH keys or configuration files, becoming world-readable and accessible to other users or processes on the same system.
The vulnerability arises from a weakness in how Composer handles path traversal and symbolic links when managing package binaries. A malicious package can declare a binary that is a symbolic link pointing to a file outside its designated directory. During the installation process, Composer might follow this link and, critically, alter the permissions of the external target file before registering it as a runnable command within the project's vendor/bin directory. While this vulnerability does not grant direct remote code execution or immediate data exfiltration, the resulting permission changes can escalate privileges for local attackers or unauthorized users on shared infrastructure.
The risk is particularly elevated in scenarios where organizations reuse vendor directories from untrusted sources. This includes vendor folders restored from CI caches, copied from earlier container build stages, retained from older Composer versions, or modified by less trusted build processes. The GitHub Advisory notes that a standard composer install command, executed within a build or deployment pipeline, could silently apply these dangerous permission modifications using the privileges of the account running Composer.
Composer has addressed this vulnerability by implementing stricter validation. The updated Composer now verifies that every declared binary resolves strictly within the directory of the package being installed. If a binary is found to point outside this designated path, Composer will now skip the file and issue a warning, rather than attempting to modify its permissions. This change aims to prevent the accidental or malicious exposure of sensitive files.
This vulnerability bypasses security measures previously implemented in an earlier Composer advisory (GHSA-gjfg-22fp-rrxx). While previous hardening efforts rejected literal ".." path segments in declared package binaries, the validation was not comprehensive enough to cover all scenarios, particularly those involving symbolic links or metadata restored from different environments. The researchers who discovered this flaw demonstrated that the validation could be circumvented under specific conditions.
Composer has released fixes for this issue in versions 2.10.3 and 2.2.30. Administrators and developers are strongly urged to upgrade to these patched versions immediately. Furthermore, it is recommended to rebuild vendor directories from trusted sources, especially within CI/CD pipelines, dependency caching mechanisms, container build processes, and deployment systems, to ensure that no compromised or maliciously altered vendor directories are in use.
The vulnerability is associated with several Common Weakness Enumeration (CWE) categories, including CWE-22 (Path Traversal), CWE-59 (Improper Link Resolution), and CWE-732 (Incorrect Permission Assignment for Critical Resources). The Common Vulnerability Scoring System (CVSS) vector indicates low attack complexity but a high confidentiality impact, underscoring the potential severity of data exposure, even though exploitation requires local execution and user interaction.