Skip to content
Threat Feed
Subscribe

Product

Composer (>= 2.3.0, < 2.10.2)

1 brief RSS
high advisory

Composer: Arbitrary File Write via Malicious Transitive Package Name

A critical vulnerability, CVE-2026-59948, in Composer allows for arbitrary file write outside the project's vendor directory when processing a maliciously crafted package from an untrusted third-party repository during `install` or `update` operations, enabling code execution.

Composer +1 php supply-chain arbitrary-file-write code-execution vulnerability
3t 1c