CVE-2026-59946
Fixed in a distro release EPSS <1%CVSS 6.1
Composer is a dependency Manager for the PHP language. Prior to 2.2.29 and 2.10.2, a Composer package bin entry containing .. path segments can resolve outside the package install directory and cause Composer's binary installation flow to chmod an existing host file to a world-readable and world-executable mode during composer install, update, or require. This issue is fixed in versions 2.2.29 and 2.10.2.
Products: composer
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| Packagist | composer/composer | 2.10.2 |
| Packagist | composer/composer | 2.2.29 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Debian 12 | composer | no fix |
| Debian 13 | composer | no fix |
| Debian 14 | composer | 2.10.2-1 |
| Red Hat hummingbird 1 | composer | 0:2.10.2-1.hum1 |
| SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS | php-composer2 | 2.2.30-150400.3.24.1 |
| SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS | php-composer2 | 2.2.30-150400.3.21.1 |
| SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS | php-composer2 | 2.2.30-150400.3.21.1 |
| SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS | php-composer2 | 2.2.30-150400.3.24.1 |
| SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS | php-composer2 | 2.2.30-150400.3.24.1 |
| SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS | php-composer2 | 2.2.30-150400.3.21.1 |
| SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS | php-composer2 | 2.2.30-150400.3.24.1 |
| SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS | php-composer2 | 2.2.30-150400.3.21.1 |
| SUSE Linux Enterprise Module for Web and Scripting 15 SP7 | php-composer2 | 2.6.4-150600.3.12.1 |
| SUSE Linux Enterprise Server 15 SP4-LTSS | php-composer2 | 2.2.30-150400.3.21.1 |
| SUSE Linux Enterprise Server 15 SP4-LTSS | php-composer2 | 2.2.30-150400.3.24.1 |
| SUSE Linux Enterprise Server 15 SP5-LTSS | php-composer2 | 2.2.30-150400.3.21.1 |
| SUSE Linux Enterprise Server 15 SP5-LTSS | php-composer2 | 2.2.30-150400.3.24.1 |
| SUSE Linux Enterprise Server 15 SP6-LTSS | php-composer2 | 2.6.4-150600.3.12.1 |
| SUSE Linux Enterprise Server 16.0 | php-composer2 | 2.8.9-160000.4.1 |
| SUSE Linux Enterprise Server for SAP Applications 15 SP4 | php-composer2 | 2.2.30-150400.3.21.1 |
| SUSE Linux Enterprise Server for SAP Applications 15 SP4 | php-composer2 | 2.2.30-150400.3.24.1 |
| SUSE Linux Enterprise Server for SAP Applications 15 SP5 | php-composer2 | 2.2.30-150400.3.21.1 |
| SUSE Linux Enterprise Server for SAP Applications 15 SP5 | php-composer2 | 2.2.30-150400.3.24.1 |
| SUSE Linux Enterprise Server for SAP Applications 15 SP6 | php-composer2 | 2.6.4-150600.3.12.1 |
| SUSE Linux Enterprise Server for SAP applications 16.0 | php-composer2 | 2.8.9-160000.4.1 |
| Ubuntu 25.10 | composer | no fix |
| Ubuntu 26.04 LTS | composer | no fix |
| Ubuntu 26.10 | composer | no fix |
| Ubuntu Pro 16.04 LTS | composer | no fix |
| Ubuntu Pro 18.04 LTS | composer | no fix |
| Ubuntu Pro 20.04 LTS | composer | no fix |
| Ubuntu Pro 22.04 LTS | composer | no fix |
| Ubuntu Pro 24.04 LTS | composer | no fix |
| openSUSE Leap 16.0 | php-composer2 | 2.8.9-160000.4.1 |
| openSUSE Tumbleweed | php-composer2 | 2.10.2-1.1 |