Executive brief
Composer is a dependency manager for PHP that automatically installs and manages software packages. A flaw allows a malicious or compromised package to bypass path validation and create executable files outside its intended directory. An attacker could modify permissions on or create proxies to files elsewhere on the system, potentially enabling privilege escalation or persistence if combined with other vulnerabilities.
Technical details
The vulnerability is a path traversal / validation bypass in Composer's binary installer. Previously, Composer validated literal ".." components in dependency metadata, but this check was insufficient: it only inspected the metadata string itself, not the actual resolved paths. A malicious package can declare a clean bin entry (e.g., "bin/pwn") while shipping it as a symlink pointing outside the package (e.g., to "../../../../victim.sh"), or inject escaping paths via the installed.json metadata during reinstall. When Composer processes the bin entry, it follows the symlink and modifies the external target's permissions and creates a vendor/bin proxy, affecting files outside the package directory. The installed-metadata path is reachable when the vendor directory is restored from cache, copied from a build stage, or carried over from an older run. The fix extracts a containment check (verifying realpath stays within the package) and applies it in both BinaryInstaller and FileDownloader sinks. Fixed in versions 2.2.30 and 2.10.3.
Affected products
- Composer Composer 1.0 through 2.2.29, 2.3.0 through 2.10.2
Timeline
- 2026-09-16: disclosed
- 2026-08-27: patched: Commits ad649fd and 53b8bb4 address the vulnerability in versions 2.2.30 and 2.10.3