DeutschShown in its original language — a full translation is planned for a future version.
Composer: Mehrere Schwachstellen
view advisory published 2026-07-07
Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Composer ausnutzen, um Sicherheitsmechanismen zu umgehen, um beliebige Dateien zu schreiben oder um Informationen offenzulegen. Zur erfolgreichen Ausnutzung sind teilweise bestimmte Konfigurationen erforderlich.
01
describes (3)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2026-59948US | — | — | ||
Composer is a dependency Manager for the PHP language. Prior to 2.2.29 and 2.10.2, a maliciously crafted package from an untrusted repository other than Packagist.org or Private Pa… | ||||
| CVE-2026-59947US | — | — | ||
Composer is a dependency Manager for the PHP language. Prior to 2.2.29 and 2.10.2, when Composer is run with -vvv debug verbosity, it could print a credential embedded in the usern… | ||||
| CVE-2026-59946US | — | — | ||
Composer is a dependency Manager for the PHP language. Prior to 2.2.29 and 2.10.2, a Composer package bin entry containing .. path segments can resolve outside the package install… | ||||
02
references
External citations — patches, advisories, analysis.
- Composer GitHub Pull Request 12946external
- Composer GitHub Pull Request 12948external
- Composer GitHub Pull Request 12959external
- Composer Release List vom 2026-07-07external
- GitHub Security Advisory GHSA-499r-g7pc-vmp9 vom 2026-07-07external
- GitHub Security Advisory GHSA-g6xq-892h-64w3 vom 2026-07-07external
- GitHub Security Advisory GHSA-gjfg-22fp-rrxx vom 2026-07-07external
- SUSE Security Update SUSE-SU-2026:23138-1 vom 2026-08-14external
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan