Link following in composer - CVE-2026-59944
Published: August 27, 2026
Vulnerability details
The vulnerability allows a remote attacker to disclose sensitive information.
The vulnerability exists due to path traversal and improper link resolution in package binary handling when installing a malicious or compromised dependency package. A remote attacker can supply a specially crafted package or manipulated installed dependency metadata to cause Composer to change permissions on a file outside the package directory and expose its contents to disclose sensitive information.
User interaction is required to install or update dependencies. The issue can be triggered through a symbolic link that resolves outside the package directory or through crafted vendor/composer/installed.json metadata when binaries are regenerated from an existing vendor directory.
Affected software
Fedora
composer
How to mitigate CVE-2026-59944
composer - addressed in versions 2.10.3-1.el9, 2.10.3-1.el10_2, 2.10.3-1.el10_3, 2.10.3-1.el10_4, 2.10.3-1.fc43, 2.10.3-1.fc44, 2.10.3-1.fc45