Reported by 2 outlets
Composer Path Traversal Flaw Lets Malicious Packages Expose Sensitive Files
Why this score
- Breadth
- 1.00 / 2.0 · 2 sources
- Authority
- 1.20 / 2.0 · best outlet weight
- Severity
- 1.50 / 5.0 · CVSS + content signals
- Velocity
- 0.00 / 2.0 · updates in 48h
- Pickup speed
- 0.59 / 0.6 · time to second source
- Recency
- × 0.00 temporal multiplier
- Community
- + 0.00 / 1.5 · reddit signal
- Score
- 0.0 / 10 = base × recency + community
Timeline
-
original reporting
Composer Path Traversal Flaw Lets Malicious Packages Expose Sensitive Files
gbhackers.com · 43d ago · August 31st, 2026
Composer users are urged to update their software following the disclosure of a path-traversal vulnerability. This flaw could allow a malicious or compromised PHP package to change file permissions outside of its own installation directory. The vulnerability is tracked as CVE-2026-59944 and GHSA-96h3-5x6v-m776, affecting Composer versions 2.3.0 through 2.10.2 and versions 1.0 through 2.2.29. Composer […] The post Composer Path Traversal Flaw Lets Malicious Packages Expose Sensitive Files appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform .
-
update from cyberpress.org
Composer Path Traversal Flaw Lets Malicious Packages Expose Sensitive Files
cyberpress.org · 43d ago · August 31st, 2026
A newly disclosed vulnerability in Composer could allow malicious or compromised PHP packages to alter permissions on files located outside their intended installation directory, potentially exposing sensitive data on shared and multi-tenant systems. Composer has addressed the issue in versions 2.10.3 and 2.2.30. The vulnerability was rated Moderate and carries a CVSS v3.1 score based on the vector CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N . It is classified under CWE-22, or path traversal; CWE-59, improper link resolution; and CWE-732, incorrect permission assignment for critical resources. Composer Path Traversal Flaw Composer packages can declare executable binaries that are made available through the vendor/bin directory. A malicious package could provide a binary path that escapes its package directory or use a symbolic link resolving to a file outside that directory. During installation, Composer may change permissions on the target file and create a runnable vendor/bin command pointing to it. If the external target file is normally readable only by its owner but remains modifiable by the Composer process, the flaw could make it world-readable and executable. This creates a confidentiality risk, as other users on a shared host could read a previously restricted file. The issue does not, by itself, enable remote code execution or give an attacker a direc