CVE-2026-59946

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-59946
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-59946.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-59946
Aliases
Downstream
Related
Published
2026-07-08T19:32:38Z
Modified
2026-08-14T18:51:33Z
Severity
  • 6.1 (Medium) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N CVSS Calculator
Summary
Composer: Path traversal in package bin field lets dependencies chmod arbitrary host files
Details

Composer is a dependency Manager for the PHP language. Prior to 2.2.29 and 2.10.2, a Composer package bin entry containing .. path segments can resolve outside the package install directory and cause Composer's binary installation flow to chmod an existing host file to a world-readable and world-executable mode during composer install, update, or require. This issue is fixed in versions 2.2.29 and 2.10.2.

Database specific 
{
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-22",
        "CWE-732"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/59xxx/CVE-2026-59946.json"
}
References

Affected packages

Git / github.com/composer/composer

Affected ranges

Type
GIT
Repo
https://github.com/composer/composer
Events
Introduced
32df3aa8cdbdaa16df9491b5e672e81c87f94c78
Introduced
934ee6eed3c3ffd0aeccef7c1d255adcf0752b24
Fixed
ccbe57917efe30262ce80463fc4a6182c5ac29ed
Fixed
8d4439f572a97670a9edc039eb3b093cc976b4bc
Fixed
502c6c4f699802d9cf464728b3e8a95674f919a0
Fixed
c50b1efd13ebd73f6dca19b31424c5a02bf93cc1
Database specific
Show details 
{
    "extracted_events": [
        {
            "introduced": "1.0"
        },
        {
            "fixed": "2.2.29"
        },
        {
            "introduced": "2.3.0"
        },
        {
            "fixed": "2.10.2"
        }
    ],
    "source": [
        "AFFECTED_FIELD",
        "REFERENCES"
    ]
}

Affected versions

2.*
2.10.0
2.10.0-RC1
2.10.0-RC2
2.10.1
2.3.0
2.3.1
2.3.2
2.3.3
2.3.4
2.3.5
2.4.0
2.4.0-RC1
2.4.1
2.5.0
2.5.1
2.5.2
2.6.0
2.6.1
2.6.2
2.6.3
2.6.4
2.6.5
2.7.0
2.7.1
2.7.2
2.7.3
2.7.4
2.7.5
2.7.6
2.7.7
2.7.8
2.7.9
2.8.0
2.8.1
2.8.2
2.8.3
2.8.4
2.8.5
2.8.6
2.8.7
2.8.8
2.8.9
2.9.0
2.9.0-RC1
2.9.1
2.9.2
2.9.3
2.9.4
2.9.5

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-59946.json"