Skip to content
Threat Feed
Subscribe

Product

Composer (< 2.2.29)

1 brief RSS
high advisory

Composer: Arbitrary File Write via Malicious Transitive Package Name

A critical vulnerability, CVE-2026-59948, in Composer allows for arbitrary file write outside the project's vendor directory when processing a maliciously crafted package from an untrusted third-party repository during `install` or `update` operations, enabling code execution.

Composer +1 php supply-chain arbitrary-file-write code-execution vulnerability
3t 1c