SB20260721146 - SUSE update for php-composer2
Published: July 21, 2026
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 9 vulnerabilities.
1) Command Injection (CVE-ID: CVE-2024-35241)
CWE-ID: CWE-77 - Command injection
CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber
The vulnerability allows a remote attacker to execute arbitrary commands on the target system.
The vulnerability exists due to improper input validation in the "status", "reinstall" and "remove" commands within git branch name. A remote attacker can pass specially crafted data to the application and execute arbitrary commands on the target system.
Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.
2) Command Injection (CVE-ID: CVE-2024-35242)
CWE-ID: CWE-77 - Command injection
CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber
3) Improper input validation (CVE-ID: CVE-2025-67746)
CWE-ID: CWE-150 - Improper Neutralization of Escape, Meta, or Control Sequences
CVSSv4: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:U/U:Green
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to improper neutralization of terminal control sequences in terminal output handling when processing data from remote sources. A remote attacker can inject ANSI control characters to cause a denial of service.
The issue may also mangle terminal output and lead to user confusion.
4) OS Command Injection (CVE-ID: CVE-2026-40176)
CWE-ID: CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber
The vulnerability allows a remote attacker to execute arbitrary commands.
The vulnerability exists due to command injection in Perforce::generateP4Command() when processing a malicious Perforce repository definition from a composer.json file. A remote attacker can supply crafted Perforce connection parameters to execute arbitrary commands.
User interaction is required because the victim must run Composer commands on an untrusted project or configuration containing the malicious repository definition.
5) OS Command Injection (CVE-ID: CVE-2026-40261)
CWE-ID: CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber
The vulnerability allows a remote attacker to execute arbitrary commands.
The vulnerability exists due to command injection in the Perforce::syncCodeBase() and Perforce::generateP4Command() methods when processing package metadata containing a crafted Perforce source reference or source url. A remote attacker can supply a malicious package through a Composer repository to execute arbitrary commands.
The issue is exploitable when installing or updating dependencies from source, including with --prefer-source and by default for dev prefixed versions. User interaction is required to install or update the dependency.
6) Information disclosure (CVE-ID: CVE-2026-45793)
CWE-ID: CWE-200 - Exposure of sensitive information to an unauthorized actor
CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Green
The vulnerability allows a remote attacker to disclose sensitive information.
The vulnerability exists due to exposure of sensitive information in Composer\IO\BaseIO::loadConfiguration() when validating GitHub OAuth tokens. A remote attacker can supply a token containing invalid characters to disclose sensitive information.
The issue is triggered when the rejected token is interpolated into an exception message and written to stderr, which may be captured in GitHub Actions logs.
7) Path traversal (CVE-ID: CVE-2026-59946)
CWE-ID: CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Green
The vulnerability allows a remote attacker to disclose sensitive information.
The vulnerability exists due to path traversal in the bin field processing in Composer when installing a package with crafted bin entries containing .. path segments. A remote attacker can trick the victim into installing a malicious dependency to disclose sensitive information.
The issue changes file permissions of an existing target file to make it world-readable and world-executable, and user interaction is required to install, update, or require the dependency.
8) Inclusion of Sensitive Information in Log Files (CVE-ID: CVE-2026-59947)
CWE-ID: CWE-532 - Information Exposure Through Log Files
CVSSv4: CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear
The vulnerability allows a local user to disclose sensitive information.
The vulnerability exists due to insertion of sensitive information into log files in Composer debug output when handling repository or package URLs with credentials embedded in the username field. A local user can run Composer with debug verbosity and cause an embedded access token to be written to verbose logs to disclose sensitive information.
Exposure occurs only when a credential is embedded in a handled URL, placed in the username slot, and the debug output is retained or shared where others can read it.
9) Path traversal (CVE-ID: CVE-2026-59948)
CWE-ID: CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CVSSv4: CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Green
The vulnerability allows a remote attacker to execute arbitrary code.
The vulnerability exists due to path traversal in package name validation when processing package metadata from an untrusted third-party repository during install or update. A remote attacker can publish a malicious package with an invalid package name to write files outside the vendor directory and outside the project to execute arbitrary code.
User interaction is required to perform a normal install or update, and exploitation requires a malicious or compromised package to be present in the dependency graph from an untrusted third-party repository.
Remediation
Install update from vendor's website.