Composer: Arbitrary File Write via Malicious Transitive Package Name

A high-severity supply-chain vulnerability (CVE-2026-59948) has been identified in Composer, the popular PHP dependency manager. This flaw allows a malicious actor to achieve arbitrary file writes outside a project's intended vendor/ directory and even outside the project root. This occurs when Composer attempts to install or update a dependency from an untrusted third-party repository, and that dependency has been maliciously crafted with an invalid package name that Composer fails to validate correctly. The vulnerability affects Composer versions older than 2.2.29 and versions between 2.3.0 and 2.10.2, as well as all 1.x versions. Attackers can exploit this to write arbitrary files such as shell startup files, SSH authorized_keys, or cron entries, leading to code execution outside the expected project context. This vulnerability is not remotely exploitable against a machine directly but requires the presence of a malicious or compromised package within the dependency graph.

Attack Chain

1. An attacker crafts a malicious PHP package with an invalid vendor/package name format.
2. The attacker publishes this malicious package to an untrusted third-party Composer repository (not Packagist.org or Private Packagist).
3. A victim's Composer project is configured to use this untrusted repository for dependency resolution.
4. The victim executes composer install or composer update within their project, causing Composer to resolve and attempt to install dependencies, including the malicious package.
5. Composer processes the malicious package, and due to a lack of proper validation, constructs a file path outside the vendor/ directory using the invalid package name.
6. Composer writes attacker-controlled content (e.g., shell startup script, SSH authorized_keys entry, cron job definition) to the arbitrary file path on the victim's system.
7. Upon the next relevant event (e.g., system boot, SSH connection, cron execution), the attacker's payload is executed, leading to remote code execution.

Impact

Successful exploitation of CVE-2026-59948 results in arbitrary file write capabilities, which can lead to full system compromise through code execution. This supply-chain vulnerability allows attackers to inject malicious code into critical system locations such as shell startup files, SSH authorized_keys, or cron entries. This can grant attackers persistent access, elevate privileges, and ultimately allow them to take complete control of the compromised server. The scope of impact is broad, affecting any organization or individual using vulnerable Composer versions with untrusted third-party repositories.

Recommendation

• Patch Composer immediately to version 2.2.29 or 2.10.2 to remediate CVE-2026-59948. Composer 1.x users should upgrade to a safe 2.x release.
• Configure Composer to avoid untrusted third-party package repositories. Review your composer.json and global Composer configurations for untrusted sources.
• If using untrusted repositories is unavoidable, mirror them through an internal repository solution, such as Private Packagist, which performs package name validation.