# CVE-2026-59948: Composer path traversal via malicious package name

Source: https://junglewise.ai/threats/cve-2026-59948-composer-path-traversal-via-malicious-package-name  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-08. Updated: 2026-07-20  
License: CC BY 4.0 with a link back

CVE-2026-59948 · Severity: high · CVSS 7 · Published 2026-07-08

Composer, a popular dependency manager for PHP, is vulnerable to a supply-chain attack when using untrusted third-party package repositories. A maliciously crafted package name can trick the tool into writing files to sensitive locations on a developer's machine or server during a standard installation or update. This could allow an attacker to gain persistent access to the system by overwriting configuration files or adding unauthorized access keys.

Technologies: [Composer (Packagist)](https://junglewise.ai/threats/technologies/composer), [composer/composer (Packagist)](https://junglewise.ai/threats/technologies/composer-composer). Vendors: [Packagist](https://junglewise.ai/threats/vendors/packagist).

## Quick answers

**Is CVE-2026-59948 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-59948 being exploited in the wild.

**How severe is CVE-2026-59948?** High severity, with a CVSS score of 7, published 8 July 2026.

**Which products and versions are affected?** Composer (Packagist) >= 1.0, < 2.2.29; >= 2.3.0, < 2.10.2, >= 1.0.0, < 2.2.29; >= 2.3.0, < 2.10.2; composer/composer (Packagist) ECOSYSTEM:introduced=2.3.0,fixed=2.10.2.

**Is there a fix for CVE-2026-59948?** Yes. composer/composer (Packagist): upgrade to 2.10.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-59948 attacked?** It is attacked with local access, in a software library.

**Am I affected by CVE-2026-59948?** Check whether you run Composer (Packagist) or composer/composer (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- composer/composer (Packagist): upgrade to 2.10.2 or later

  ```sh
  composer require composer/composer:^2.10.2
  ```


## Technical details

Composer fails to properly validate package names during dependency resolution when using third-party repositories. An attacker can publish a package with a specially crafted name (utilizing path traversal or invalid characters) that causes Composer to write files outside the intended 'vendor/' directory during 'install' or 'update' operations. This vulnerability, classified under CWE-22 and CWE-787, allows for the creation or overwriting of arbitrary files, such as cron jobs or SSH authorized_keys, leading to code execution. The issue is fixed in versions 2.2.29 and 2.10.2 by implementing strict validation of package names before any disk writes occur.

## Affected products

- Composer composer/composer >= 1.0.0, < 2.2.29; >= 2.3.0, < 2.10.2

## Identifiers

- CVE-2026-59948
- GHSA-499r-g7pc-vmp9

## Timeline

- 2026-07-01: disclosed: Initial disclosure by Seldaek
- 2026-07-08: advisory: NVD publication
- 2026-07-20: patched: GitHub Advisory reviewed and updated with patched versions

## References

- [https://api.github.com/users/iliaal](https://api.github.com/users/iliaal)
- [https://github.com/iliaal](https://github.com/iliaal)
- [https://api.github.com/users/iliaal/gists%7B/gist_id%7D](https://api.github.com/users/iliaal/gists%7B/gist_id%7D)
- [https://api.github.com/users/iliaal/repos](https://api.github.com/users/iliaal/repos)
- [https://avatars.githubusercontent.com/u/158724?v=4](https://avatars.githubusercontent.com/u/158724?v=4)
- [https://api.github.com/users/iliaal/events%7B/privacy%7D](https://api.github.com/users/iliaal/events%7B/privacy%7D)

## Related threats

- [Composer bin path validation bypass via symlinks](https://junglewise.ai/threats/cve-2026-59944-composer-bin-path-validation-bypass-via-symlinks)
- [Composer arbitrary command execution via malicious Perforce source URL](https://junglewise.ai/threats/cve-2026-84361-composer-arbitrary-command-execution-via-malicious-perforce)
- [Composer sensitive information disclosure in GitHub token validation](https://junglewise.ai/threats/cve-2026-45793-composer-sensitive-information-disclosure-in-github-token)
- [Composer sensitive information disclosure in verbose debug output](https://junglewise.ai/threats/cve-2026-59947-composer-sensitive-information-disclosure-in-verbose-debug-output)
- [Composer path traversal in package bin field](https://junglewise.ai/threats/cve-2026-59946-composer-path-traversal-in-package-bin-field)