CVE-2026-59946: Composer Path Traversal Vulnerability

CVE-2026-59946 Overview

CVE-2026-59946 is a path traversal vulnerability [CWE-22] in Composer, the dependency manager for the PHP language. A package bin entry containing .. path segments can resolve outside the intended package installation directory. During composer install, composer update, or composer require, the binary installation flow calls chmod on the resolved path and applies world-readable and world-executable permissions to an existing host file. The issue affects Composer versions prior to 2.2.29 and 2.10.2, and is fixed in those releases.

Critical Impact
A malicious package can force Composer to change the permissions of arbitrary host files to world-readable and world-executable, weakening the security posture of the affected system.

Affected Products

Composer versions prior to 2.2.29 (2.2.x branch)
Composer versions prior to 2.10.2 (2.x branch)
PHP projects consuming untrusted or compromised Composer packages

Discovery Timeline

2026-07-08 - CVE-2026-59946 published to NVD
2026-07-08 - Last updated in NVD database

Technical Details for CVE-2026-59946

Vulnerability Analysis

Composer installs package binaries declared under the bin key in a package's composer.json. The installation routine builds a target path by concatenating the package install directory with the bin entry value, then invokes chmod on that path to make the binary executable. Prior to the patched releases, Composer did not validate that the resulting path stayed within the package directory. A crafted bin entry such as ../../../etc/hosts resolves outside the vendor tree and points to an existing host file.

The result is that composer install, composer update, or composer require applies world-readable and world-executable permissions (mode 0755) to arbitrary files reachable by the process. The attacker needs no elevated privileges; the file simply must be writable in metadata sense by the user running Composer. Exploitation requires user interaction, since a developer or CI system must install the malicious package.

Root Cause

The root cause is missing input validation on the bin field of package metadata. Composer trusted the value as a relative path without ensuring the canonicalized target remained inside the package install directory. The fix introduces a ValidatingArrayLoader reference and a new SecurityException class to reject bin entries containing traversal segments before the file operation runs.

Attack Vector

An attacker publishes a package to a registry such as Packagist, or compromises an existing package, and adds a bin entry with .. path segments. When a victim installs or updates dependencies, Composer resolves the traversal path and applies chmod 0755 to the referenced host file. Suitable targets include configuration files, credential stores, or scripts whose permission changes weaken subsequent access controls or enable local privilege escalation chains.

php

// Security patch — new SecurityException class added by the fix
<?php declare(strict_types=1);

namespace Composer\Exception;

/**
 * @author Jordi Boggiano <j.boggiano@seld.be>
 */
class SecurityException extends \UnexpectedValueException
{
}

Source: Composer commit 502c6c4

php

// LockTransaction.php now imports ValidatingArrayLoader for bin path validation
use Composer\Package\AliasPackage;
use Composer\Package\BasePackage;
use Composer\Package\Loader\ValidatingArrayLoader;
use Composer\Package\Package;
use Composer\Pcre\Preg;

Source: Composer commit c50b1ef

Detection Methods for CVE-2026-59946

Indicators of Compromise

Package composer.json files declaring bin entries containing .., absolute paths, or references outside the package directory
Host files unexpectedly transitioning to mode 0755 (world-readable and world-executable) immediately following a Composer operation
Unexplained chmod syscalls originating from the php or composer process against files outside vendor/

Detection Strategies

Scan cached and installed composer.json files for bin values matching the pattern \.\.[\\/] or beginning with /
Audit CI/CD build logs for Composer output referencing binary installation paths outside the project's vendor/bin directory
Compare pre- and post-install file permission snapshots on developer workstations and build agents to flag unauthorized mode changes

Monitoring Recommendations

Alert on chmod operations against sensitive paths such as /etc, /usr/local, and user home directories when the parent process is composer or php
Track Composer version inventory across development, CI, and production hosts and flag any instance below 2.2.29 or 2.10.2
Monitor package registry pulls for newly published or updated dependencies containing malformed bin entries

How to Mitigate CVE-2026-59946

Immediate Actions Required

Upgrade Composer to version 2.2.29 on the 2.2.x branch or 2.10.2 on the 2.x branch across all developer workstations, CI runners, and container images
Audit recently installed dependencies for bin entries containing .. path segments and remove or replace any suspicious packages
Review permissions on sensitive host files that may have been altered by prior Composer operations and restore expected modes

Patch Information

The maintainers released fixes in Composer 2.10.2 and Composer 2.2.29. Technical detail is available in the GitHub Security Advisory GHSA-gjfg-22fp-rrxx and the fix commits 502c6c4 and c50b1ef. The patch adds a SecurityException class and validates bin entries through ValidatingArrayLoader before invoking file operations.

Workarounds

Run Composer operations under a dedicated low-privilege user account with no write or ownership access to sensitive system files
Restrict dependency sources to a curated internal proxy such as Private Packagist or Satis, and block direct pulls from untrusted registries
Execute composer install inside ephemeral containers so that any file-permission changes are discarded when the container exits

bash

# Upgrade Composer to a patched release
composer self-update 2.10.2

# Or for the 2.2.x LTS branch
composer self-update 2.2.29

# Verify the installed version
composer --version