CVE-2026-59944: Composer Vulnerability Allows Bypass of Binary Path Hardening
Summary
CVE-2026-59944: Composer: CVE-2026-59946 fix bypass via symlinked package bin path. Affects composer across 2 version ranges.
>= 1.0.0, < 2.2.30
>= 2.3.0, < 2.10.3
Fixed in 2.2.30 or 2.10.3, depending on the release line you run. How to fix ↓
Also tracked for
- composer/composer · Packagist
The same CVE-2026-59944 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Composer is a widely-used dependency manager for PHP, enabling developers to manage libraries and packages efficiently. It simplifies the process of installing, updating, and managing dependencies in PHP projects. However, certain versions of Composer are vulnerable to a security flaw that can allow malicious dependencies to bypass binary path hardening, potentially leading to security risks.
Vulnerability Detail
The vulnerability arises from Composer's handling of binary paths during dependency resolution. Specifically, from versions 1.0 to 2.2.30 and from 2.3.0 to 2.10.3, Composer only validates parent-directory segments during dependency resolution. This oversight allows a malicious package to create a symlink that points outside its installation directory. If an attacker can influence the installed-metadata paths, they can provide a binary path that escapes the intended directory. This can lead to the creation of a runnable proxy to an external file, although it does not directly read or transmit data or provide remote code execution.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 1.0.0, < 2.2.302.2.30 -
>= 2.3.0, < 2.10.32.10.3
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If immediate updating is not feasible, consider restricting access to the vendor directory and ensuring that it is not writable by lower-trust build steps. This can help mitigate the risk of an attacker influencing the installed-metadata paths.
Conclusion
The CVE-2026-59944 vulnerability in Composer poses a significant risk by allowing malicious dependencies to bypass binary path hardening. It is crucial for users to update to the latest patched versions to safeguard their applications. Additionally, employing workarounds can help mitigate risks until an update can be performed.
See every vulnerability recorded for composer →
FAQ
Versions from 1.0 to 2.2.30 and from 2.3.0 to 2.10.3 are affected.
The main risk is that a malicious package can create a symlink that points to an external file, potentially leading to unauthorized access or execution of that file.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Visit Vulert Scanner to check your application without needing to sign up.
Yes, you can restrict access to the vendor directory and ensure it is not writable by lower-trust build steps to mitigate the risk.
If you experience issues after updating, consult the Composer documentation or community forums for troubleshooting assistance.
References
Related vulnerabilities
Recent vulnerabilities recorded for composer.
