BIT-composer-2026-59946

See a problem?
Import Source
https://github.com/bitnami/vulndb/tree/main/data/composer/BIT-composer-2026-59946.json
JSON Data
https://api.osv.dev/v1/vulns/BIT-composer-2026-59946
Aliases
Published
2026-07-14T08:40:58.630Z
Modified
2026-07-14T10:11:35.940595869Z
Summary
Composer: Path traversal in package bin field lets dependencies chmod arbitrary host files
Details

Composer is a dependency Manager for the PHP language. Prior to 2.2.29 and 2.10.2, a Composer package bin entry containing .. path segments can resolve outside the package install directory and cause Composer's binary installation flow to chmod an existing host file to a world-readable and world-executable mode during composer install, update, or require. This issue is fixed in versions 2.2.29 and 2.10.2.

Database specific 
{
    "severity": "Medium",
    "cpes": [
        "cpe:2.3:a:getcomposer:composer:*:*:*:*:*:*:*:*"
    ]
}
References

Affected packages

Bitnami / composer

Package

Name
composer
Purl
pkg:bitnami/composer

Severity

  • 6.1 (Medium) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N CVSS Calculator

Affected ranges

Type
SEMVER
Events
Introduced
1.0.0
Fixed
2.2.29
Introduced
2.3.0
Fixed
2.10.2

Database specific

source 
"https://github.com/bitnami/vulndb/tree/main/data/composer/BIT-composer-2026-59946.json"