CVE-2026-59944

medium

EUVD alias: EUVD-2026-80863

Assigned by CNA: github_m

Published 2026-09-16 · Modified 2026-09-16

Discuss on Community Propose mitigation

CVSS v3

6.1

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N

CVSS v4 NEW

—

not yet in upstream

VIR risk

6.1

Description

Composer is a dependency Manager for the PHP language. From 1.0 until 2.2.30 and from 2.3.0 until 2.10.3, a malicious or compromised dependency can bypass the earlier CVE-2026-59946 binary-path hardening because Composer validates literal parent-directory segments only during dependency resolution, while the symlink and installed-metadata paths described by the advisory skip that validation. A package can ship an in-package binary symlink that resolves outside its installation directory, or attacker-influenced vendor/composer/installed.json metadata can provide an escaping binary path during a reinstall or regeneration of missing vendor/bin entries. The installed-metadata path is reachable only when the vendor directory was not populated by the same validated install run, such as when it is restored from an untrusted cache, copied from an earlier build stage, carried over from an older Composer run, or writable by a lower-trust build step. Composer can follow the path, change the external target's permissions to make it world-readable and executable, and create a runnable vendor/bin proxy to that external file. The issue does not directly read or transmit data and does not by itself provide remote code execution. This issue is fixed in versions 2.2.30 and 2.10.3.

Predictions

Exploit likelihood

61%

Patch ETA

—

Heuristic predictions, AS-IS, for prioritization only.

Mitigations

Mitigation details

Source: Debian Security Tracker · View original ↗ · DFSG

CVE-2026-59944 NameCVE-2026-59944 SourceCVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more) Vulnerable and fixed packages The table below lists information on source packages. Source PackageReleaseVersionStatus composer (PTS)bullseye (security), bullseye2.0.9-2+deb11u4vulnerable…

CVE-2026-59944

Name	CVE-2026-59944
Source	CVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
composer (PTS)	bullseye (security), bullseye	2.0.9-2+deb11u4	vulnerable
	bookworm	2.5.5-1+deb12u5	vulnerable
	bookworm (security)	2.5.5-1+deb12u2	vulnerable
	trixie	2.8.8-1+deb13u3	vulnerable
	forky	2.10.2-1	vulnerable
	sid	2.10.3-1	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
composer	source	(unstable)	2.10.3-1

Notes

[trixie] - composer <no-dsa> (Minor issue)
https://github.com/composer/composer/security/advisories/GHSA-96h3-5x6v-m776
Fixed by: https://github.com/composer/composer/commit/53b8bb4c24697b2f00a18cf1ef35a10392701b89 (2.10.3)
Fixed by: https://github.com/composer/composer/commit/ad649fdfdf8ed826d4a34e0e5690c76a0b4833aa (2.2.30)

Home - Debian Security - Source (Git)

Apply commands

text fix

Notes

[trixie] - composer <no-dsa> (Minor issue)https://github.com/composer/composer/security/advisories/GHSA-96h3-5x6v-m776Fixed by: https://github.com/composer/composer/commit/53b8bb4c24697b2f00a18cf1ef35a10392701b89 (2.10.3)Fixed by: https://github.com/composer/composer/commit/ad649fdfdf8ed826d4a34e0e5690c76a0b4833aa (2.2.30)

OS impact

SUSE Affected 1 release

Version	Status	Fixed in
—	Affected	—

Debian Mixed 5 releases

Version	Status	Fixed in
trixie	Affected	—
sid	Fixed	`2.10.3-1`
forky	Fixed	`2.10.3-1`
bullseye	Affected	—
bookworm	Affected	—

References

CWEs

CWE-22 CWE-59

Community-verified mitigations for this CVE will appear above when contributors publish them.

Verify integrity in audit chain (admin only). AS-IS.