Link following in composer - CVE-2026-59944
Published: August 27, 2026
Vulnerability details
The vulnerability allows a remote attacker to disclose sensitive information.
The vulnerability exists due to path traversal and improper link resolution in package binary handling when installing a malicious or compromised dependency package. A remote attacker can supply a specially crafted package or manipulated installed dependency metadata to cause Composer to change permissions on a file outside the package directory and expose its contents to disclose sensitive information.
User interaction is required to install or update dependencies. The issue can be triggered through a symbolic link that resolves outside the package directory or through crafted vendor/composer/installed.json metadata when binaries are regenerated from an existing vendor directory.
Affected software
SUSE Linux Enterprise Server 15 SP5
SUSE Linux Enterprise Server 15 SP4
SUSE Linux Enterprise Server for SAP Applications 15
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise High Performance Computing LTSS 15
SUSE Linux Enterprise High Performance Computing ESPOS 15
SUSE Linux Enterprise High Performance Computing 15
Fedora
Web and Scripting Module
openSUSE Leap
php-composer2
composer
How to mitigate CVE-2026-59944
php-composer2 - addressed in versions 2.2.30-150400.3.21.1, 2.6.4-150600.3.23.1
composer - addressed in versions 2.10.3-1.el9, 2.10.3-1.el10_2, 2.10.3-1.el10_3, 2.10.3-1.el10_4, 2.10.3-1.fc43, 2.10.3-1.fc44, 2.10.3-1.fc45
External References
Related Security Bulletins
- Multiple vulnerabilities in composer
- Fedora EPEL 10.4 update for composer
- Fedora EPEL 10.2 update for composer
- Fedora 43 update for composer
- Fedora 44 update for composer
- Fedora 45 update for composer
- Fedora EPEL 9 update for composer
- Fedora EPEL 10.3 update for composer
- SUSE update for php-composer2
- SUSE update for php-composer2