CVE-2026-59946

6.1 Moyenne

Publiée le 08/07/2026 à 22:16 · Modifiée le 10/07/2026 à 21:14 · Analyse NVD reportée · Source : security-advisories@github.com

Description

Composer is a dependency Manager for the PHP language. Prior to 2.2.29 and 2.10.2, a Composer package bin entry containing .. path segments can resolve outside the package install directory and cause Composer's binary installation flow to chmod an existing host file to a world-readable and world-executable mode during composer install, update, or require. This issue is fixed in versions 2.2.29 and 2.10.2.

Traduire en français

Produits concernés

composer

Scores CVSS

Version	Score	Source	Vecteur
3.1	6.1 Moyenne	security-advisories@github.com	`CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N`

Faiblesses (CWE)

CWE-22
CWE-732

Références

https://github.com/composer/composer/commit/502c6c4f699802d9cf464728b3e8a95674f919a0
https://github.com/composer/composer/commit/c50b1efd13ebd73f6dca19b31424c5a02bf93cc1
https://github.com/composer/composer/releases/tag/2.10.2
https://github.com/composer/composer/releases/tag/2.2.29
https://github.com/composer/composer/security/advisories/GHSA-gjfg-22fp-rrxx

Ailleurs

NVD
CVE.org
CIRCL Vulnerability-Lookup
CERT-FR
GitHub Advisories