CVE-2026-59944: Composer bin path validation bypass via symlinks

CVE-2026-59944 · Severity: medium · CVSS 6.1 · Published 2026-09-16

Composer is a dependency manager for PHP that automatically installs and manages software packages. A flaw allows a malicious or compromised package to bypass path validation and create executable files outside its intended directory. An attacker could modify permissions on or create proxies to files elsewhere on the system, potentially enabling privilege escalation or persistence if combined with other vulnerabilities.

Technologies: Composer (Packagist), composer/composer (Packagist). Vendors: Packagist.

Quick answers

Is CVE-2026-59944 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-59944 being exploited in the wild.
How severe is CVE-2026-59944?
Medium severity, with a CVSS score of 6.1, published 16 September 2026.
Which products and versions are affected?
Composer (Packagist) 1.0 through 2.2.29, 2.3.0 through 2.10.2; composer/composer (Packagist) ECOSYSTEM:introduced=2.3.0,fixed=2.10.3.
Is there a fix for CVE-2026-59944?
Yes. composer/composer (Packagist): upgrade to 2.10.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-59944 attacked?
It is attacked with local access.
Am I affected by CVE-2026-59944?
Check whether you run Composer (Packagist) or composer/composer (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • composer/composer (Packagist): upgrade to 2.10.3 or later
    composer require composer/composer:^2.10.3

Technical details

The vulnerability is a path traversal / validation bypass in Composer's binary installer. Previously, Composer validated literal ".." components in dependency metadata, but this check was insufficient: it only inspected the metadata string itself, not the actual resolved paths. A malicious package can declare a clean bin entry (e.g., "bin/pwn") while shipping it as a symlink pointing outside the package (e.g., to "../../../../victim.sh"), or inject escaping paths via the installed.json metadata during reinstall. When Composer processes the bin entry, it follows the symlink and modifies the external target's permissions and creates a vendor/bin proxy, affecting files outside the package directory. The installed-metadata path is reachable when the vendor directory is restored from cache, copied from a build stage, or carried over from an older run. The fix extracts a containment check (verifying realpath stays within the package) and applies it in both BinaryInstaller and FileDownloader sinks. Fixed in versions 2.2.30 and 2.10.3.

Affected products

  • Composer Composer 1.0 through 2.2.29, 2.3.0 through 2.10.2

Identifiers

  • CVE-2026-59944
  • BIT-COMPOSER-2026-59944
  • GHSA-96h3-5x6v-m776

Timeline

  • 2026-09-16: disclosed
  • 2026-08-27: patched: Commits ad649fd and 53b8bb4 address the vulnerability in versions 2.2.30 and 2.10.3

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.