Do Son 
TL;DR
Composer, the package manager used by most PHP projects, patched two security flaws on August 27, 2026. One, tracked as CVE-2026-59944, lets a malicious package escape its own directory. The other allows arbitrary command execution through a crafted Perforce source URL. Both are fixed in Composer 2.10.3 and 2.2.30.
Why It Matters
Composer sits at the heart of the PHP supply chain. A single poisoned dependency, even a transitive one, can reach thousands of downstream projects. These Composer vulnerabilities turn a routine install into a security risk. Build and deploy pipelines are the most exposed, since they often run with elevated privileges.
How the Attacks Work
CVE-2026-59944: Bin Path Escape
The first issue is a path traversal and link-following flaw. A malicious package can declare a binary that resolves outside its own folder. Composer then changes that file’s permissions and registers a runnable command pointing at it. As the Composer bin path advisory explains, a file readable only by its owner can become world-readable and executable. This exposes its contents on shared or multi-tenant hosts.
Arbitrary Command Execution via Perforce
The second flaw is more severe, rated CVSS 7.7. If the p4 Perforce client is installed, a malicious package can trigger arbitrary command execution. Composer passed a package’s Perforce source address to the p4 client without checking it. The client accepts addresses that “run this local command” instead of connecting to a server. The Perforce command execution advisory confirms this runs with the privileges of the Composer user.
Affected Versions
Both flaws affect Composer from 1.0 up to 2.2.30, and from 2.3.0 up to 2.10.3. Packagist.org users are safe from the Perforce flaw, since it rejects Perforce source metadata. Most users lack the p4 client, which further limits the command execution flaw.
Patch and Mitigation
Update to Composer 2.10.3 or 2.2.30 without delay. Upgrading is the only complete fix for both CVE-2026-59944 and the Perforce flaw. As a stopgap, remove the p4 client from the PATH on machines that do not use Perforce. Also restrict repositories to trusted sources, and treat lock files from unknown origins as untrusted. The maintainers report no in-the-wild exploitation and no public proof-of-concept at this time.
Support Our Threat Intelligence
Find our zero-day alerts and CVE reports helpful? Support our work today and unlock a 100% ad-free reading experience!
Buy Me a Coffee
PayPal
