CVE-2026-59944 in Composer
Summary
by MITRE • 09/17/2026
Composer is a dependency Manager for the PHP language. From 1.0 until 2.2.30 and from 2.3.0 until 2.10.3, a malicious or compromised dependency can bypass the earlier CVE-2026-59946 binary-path hardening because Composer validates literal parent-directory segments only during dependency resolution, while the symlink and installed-metadata paths described by the advisory skip that validation. A package can ship an in-package binary symlink that resolves outside its installation directory, or attacker-influenced vendor/composer/installed.json metadata can provide an escaping binary path during a reinstall or regeneration of missing vendor/bin entries. The installed-metadata path is reachable only when the vendor directory was not populated by the same validated install run, such as when it is restored from an untrusted cache, copied from an earlier build stage, carried over from an older Composer run, or writable by a lower-trust build step. Composer can follow the path, change the external target's permissions to make it world-readable and executable, and create a runnable vendor/bin proxy to that external file. The issue does not directly read or transmit data and does not by itself provide remote code execution. This issue is fixed in versions 2.2.30 and 2.10.3.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 09/17/2026
The vulnerability identified as CVE-2026-59946 represents a significant security flaw within the Composer dependency manager for PHP, affecting version ranges from 1.0 through 2.2.30 and from 2.3.0 through 2.10.3. This issue stems from an inconsistency in how binary path hardening is enforced during different phases of package installation. Specifically, while Composer validates literal parent-directory segments to prevent directory traversal attacks during the initial dependency resolution phase, it fails to apply this same rigorous validation when processing symlink targets and installed metadata paths. This discrepancy allows a malicious or compromised PHP package to bypass security controls that are designed to keep executable binaries confined within their designated vendor directories. The core technical flaw lies in the fact that Composer validates literal parent-directory segments only during dependency resolution, whereas the symlink and installed-metadata paths described by the advisory skip this critical validation step entirely.
The operational impact of this vulnerability is centered on the potential for arbitrary code execution through path manipulation rather than direct data exfiltration or remote code execution via network vectors. A package can ship an in-package binary symlink that resolves to a location outside its installation directory, effectively escaping the sandboxed environment intended by Composer's security model. Furthermore, if an attacker influences the vendor/composer/installed.json metadata file, they can provide an escaping binary path during a reinstall or regeneration of missing vendor/bin entries. This scenario is particularly dangerous in continuous integration and deployment pipelines where build artifacts may be cached or copied between stages without proper re-validation. The installed-metadata path becomes reachable when the vendor directory was not populated by the same validated install run, such as when it is restored from an untrusted cache, copied from an earlier build stage, carried over from an older Composer run, or writable by a lower-trust build step.
When Composer encounters these malformed paths, it follows them and changes the external target's permissions to make it world-readable and executable. It then creates a runnable vendor/bin proxy to that external file. This mechanism allows attackers to execute arbitrary binaries located outside the project directory structure under the guise of legitimate package executables. Although this issue does not directly read or transmit data, nor does it by itself provide remote code execution in the traditional sense, it facilitates privilege escalation and lateral movement within a build environment. An attacker who controls a compromised dependency can leverage this flaw to inject malicious scripts into the system path, potentially leading to full compromise of the development or deployment infrastructure if subsequent steps trust these binaries without further verification.
From an industry standards perspective, this vulnerability aligns with CWE-22: Improper Limitation of a Pathname to a Restricted Directory, as it involves directory traversal that allows access outside restricted directories. It also relates to CWE-94: Improper Control of Generation of Code (Code Injection) because the execution of arbitrary binaries is facilitated through manipulated metadata and symlinks. In terms of the MITRE ATT&CK framework, this behavior maps to T1059: Command and Scripting Interpreter, specifically where an attacker uses system scripts or executables for malicious purposes after bypassing initial containment controls. The vulnerability highlights a critical gap in supply chain security within PHP ecosystems, emphasizing the need for consistent validation across all metadata processing stages.
To mitigate this risk, organizations must upgrade to Composer versions 2.2.30 and 2.10.3 or later, where these path validation inconsistencies have been addressed. In environments where upgrading is not immediately feasible, developers should enforce strict integrity checks on the vendor/composer/installed.json file before any installation or regeneration processes occur. It is crucial to ensure that build artifacts are never restored from untrusted caches and that the vendor directory is always populated by a validated install run within the same trusted context. Additionally, implementing continuous monitoring for unexpected symlink targets in binary directories can help detect attempts to exploit this flaw during development and deployment phases.