Path traversal in composer - #VU159579
Published: November 6, 2026
Vulnerability identifier: #VU159579
CSH Severity: High
CVSS v4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: N/A
CWE-ID: CWE-22
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows an unauthenticated local attacker to delete directories and write package files outside vendor/ with the privileges of the user running Composer.
The vulnerability exists due to missing validation of package names containing .. path segments in vendor/composer/installed.json during installation or reinstallation. An unauthenticated local attacker can tamper with this file before a victim runs Composer, triggering directory deletion during installation or reinstallation and file writes during reinstallation.
Affected software
composer
Remediation
Install security update from vendor's website.
composer - addressed in versions 2.2.31, 2.11.0