Link following in composer - #VU165351
Published: November 11, 2026
Vulnerability identifier: #VU165351
CSH Severity: High
CVSS v4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: N/A
CWE-ID: CWE-59
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to write arbitrary files outside the package directory and potentially execute arbitrary code.
The vulnerability exists due to improper symbolic link resolution in Composer's extraction fallback from unzip to ZipArchive when processing crafted ZIP archives with both unzip and the PHP zip extension available. A remote attacker can trick a victim into installing or updating a package from an attacker-controlled archive containing symlinked entries to overwrite files that execute on a subsequent request or command.
Affected software
composer
Remediation
Install security update from vendor's website.
composer - addressed in versions 2.2.32, 2.11.2