BIT-composer-2026-59948

See a problem?
Import Source
https://github.com/bitnami/vulndb/tree/main/data/composer/BIT-composer-2026-59948.json
JSON Data
https://api.osv.dev/v1/vulns/BIT-composer-2026-59948
Aliases
Published
2026-07-14T08:41:01.133Z
Modified
2026-07-14T10:11:19.248172340Z
Summary
Composer: Arbitrary file write outside vendor via malicious transitive package name
Details

Composer is a dependency Manager for the PHP language. Prior to 2.2.29 and 2.10.2, a maliciously crafted package from an untrusted repository other than Packagist.org or Private Packagist can cause Composer to write attacker-controlled files outside the vendor directory and outside the project during install or update by using an invalid package name that is not correctly validated before dependency-resolution results are written or installed. This issue is fixed in versions 2.2.29 and 2.10.2.

Database specific 
{
    "severity": "High",
    "cpes": [
        "cpe:2.3:a:getcomposer:composer:*:*:*:*:*:*:*:*"
    ]
}
References

Affected packages

Bitnami / composer

Package

Name
composer
Purl
pkg:bitnami/composer

Severity

  • 7.0 (High) CVSS_V3 - CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H CVSS Calculator

Affected ranges

Type
SEMVER
Events
Introduced
1.0.0
Fixed
2.2.29
Introduced
2.3.0
Fixed
2.10.2

Database specific

source 
"https://github.com/bitnami/vulndb/tree/main/data/composer/BIT-composer-2026-59948.json"