Executive brief
Composer, a popular dependency manager for PHP, is vulnerable to a supply-chain attack when using untrusted third-party package repositories. A maliciously crafted package name can trick the tool into writing files to sensitive locations on a developer's machine or server during a standard installation or update. This could allow an attacker to gain persistent access to the system by overwriting configuration files or adding unauthorized access keys.
Technical details
Composer fails to properly validate package names during dependency resolution when using third-party repositories. An attacker can publish a package with a specially crafted name (utilizing path traversal or invalid characters) that causes Composer to write files outside the intended 'vendor/' directory during 'install' or 'update' operations. This vulnerability, classified under CWE-22 and CWE-787, allows for the creation or overwriting of arbitrary files, such as cron jobs or SSH authorized_keys, leading to code execution. The issue is fixed in versions 2.2.29 and 2.10.2 by implementing strict validation of package names before any disk writes occur.
Affected products
- Composer composer/composer >= 1.0.0, < 2.2.29; >= 2.3.0, < 2.10.2
Timeline
- 2026-07-01: disclosed: Initial disclosure by Seldaek
- 2026-07-08: advisory: NVD publication
- 2026-07-20: patched: GitHub Advisory reviewed and updated with patched versions