Composer is a dependency Manager for the PHP language. Prior to 1.10.28, 2.2.28, and 2.9.8, Composer\IO\BaseIO::loadConfiguration() validates GitHub OAuth tokens with the regex ^[.A-Za-z0-9_]+$ and interpolates rejected tokens into an UnexpectedValueException; GitHub Actions GITHUB_TOKEN values using the ghs_<id>_<base64url-JWT> format can contain -, fail validation, and be disclosed to stderr or CI logs. This issue is fixed in versions 1.10.28, 2.2.28, and 2.9.8.

The remote SUSE Linux SLES16 / SLES_SAP16 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:23943-1 advisory.

    - CVE-2026-59944: path traversal and link following issue can make files world readable and executable     (bsc#1279898).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote openSUSE 16 host has a package installed that is affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21970-1 advisory.

    - CVE-2026-59944: path traversal and link following issue can make files world readable and executable     (bsc#1279898).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:4288-1 advisory.

    - CVE-2026-59944: path traversal and link following issue can make files world readable and executable     (bsc#1279898).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:4283-1 advisory.

    - CVE-2026-45793: GitHub OAuth tokens failing regex validation can cause credential disclosure     (bsc#1271504).
    - CVE-2026-59944: path traversal and link following issue can make files world readable and executable     (bsc#1279898).
    - CVE-2026-59946: package bin entries with path segments can cause unintended host file permission     modifications       (bsc#1271152).
    - CVE-2026-59947: unsanitized URL credential handling in debug output within Composer can allow sensitive     token       disclosure (bsc#1271130).
    - CVE-2026-59948: missing package name validation during dependency resolution in Composer can allow path     traversal       (bsc#1271123).
    - CVE-2026-84361: arbitrary code execution via malicious Perforce source URL (bsc#1278257).

    Changes for php-composer2:

    - version update to 2.2.30:

     * Fixed command injection via malicious Perforce url (GHSA-rvx4-ffvw-m9q3)
     * Sanitize URL-embedded usernames/token in a few more places (#13045)
     * Fixed matching of gitlab URLs to avoid possible credential leak to the wrong domain (#13042)

    - fix a regression on s390x due last change (bsc#1271729).

    - version update to 2.2.29:

     * Validate package names (GHSA-499r-g7pc-vmp9)
     * Validate package bin paths against path traversal (GHSA-gjfg-22fp-rrxx)
     * Sanitize URL-embedded usernames/token in verbose output (GHSA-g6xq-892h-64w3)
     * Only follow HTTP redirects from HTTP responses (#12948)
     * Prevent phar metadata unserialization on unsafe PHP versions (#12946)
     * Sanitize JSON parse errors in http responses to avoid leaking response body data (#12959)
     * Fixed GitHub token validation to be even more relaxed (#12856)

    - version update to 2.2.28.

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote openSUSE 16 host has a package installed that is affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21520-1 advisory.

    - CVE-2026-45793: Github Actions issued `GITHUB_TOKEN` disclosure in GitHub Actions logs (bsc#1271504).
    - CVE-2026-59946: path traversal in package `bin` field lets dependencies `chmod` arbitrary host files     (bsc#1271151).
    - CVE-2026-59947: URL-embedded HTTP-Basic username leaks to verbose logs  (bsc#1271129).
    - CVE-2026-59948: arbitrary file write outside `vendor`directory via malicious transitive package name     (bsc#1271122).

    Changes for php-composer2:

    - fix byte-swapped signature on s390x can cause broken or unsupported signature (bsc#1271729).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3105-1 advisory.

    - CVE-2026-45793: Github Actions issued `GITHUB_TOKEN` disclosure in GitHub Actions logs (bsc#1271504).
    - CVE-2026-59946: path traversal in package `bin` field lets dependencies `chmod` arbitrary host files     (bsc#1271151).
    - CVE-2026-59947: URL-embedded HTTP-Basic username leaks to verbose logs  (bsc#1271129).
    - CVE-2026-59948: arbitrary file write outside `vendor`directory via malicious transitive package name     (bsc#1271122).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2026-1800 advisory.

    Github Actions issued GITHUB_TOKEN disclosure in GitHub Actions logs (CVE-2026-45793)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Composer is a dependency Manager for the PHP language. Prior to 1.10.28, 2.2.28, and 2.9.8,     Composer\IO\BaseIO::loadConfiguration() validates GitHub OAuth tokens with the regex ^[.A-Za-z0-9_]+$ and     interpolates rejected tokens into an UnexpectedValueException; GitHub Actions GITHUB_TOKEN values using     the ghs_<id>_<base64url-JWT> format can contain -, fail validation, and be disclosed to stderr or CI logs.
    This issue is fixed in versions 1.10.28, 2.2.28, and 2.9.8. (CVE-2026-45793)

Note that Nessus relies on the presence of the package as reported by the vendor.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Composer is a dependency Manager for the PHP language. Prior to 1.10.28, 2.2.28, and 2.9.8,
    Composer\IO\BaseIO::loadConfiguration() validates GitHub OAuth tokens with the regex ^[.A-Za-z0-9_]+$ and
    interpolates rejected tokens into an UnexpectedValueException; GitHub Actions GITHUB_TOKEN values using
    the ghs_<id>_<base64url-JWT> format can contain -, fail validation, and be disclosed to stderr or CI logs.
    This issue is fixed in versions 1.10.28, 2.2.28, and 2.9.8. (CVE-2026-45793)

ID	Name	Product	Family	Type	Severity
362582	SUSE SLES16 Security Update : php-composer2 (SUSE-SU-2026:23943-1)	Nessus	SuSE Local Security Checks	Local	high
362504	openSUSE 16 Security Update : php-composer2 (openSUSE-SU-2026:21970-1)	Nessus	SuSE Local Security Checks	Local	high
349191	SUSE SLES15 Security Update : php-composer2 (SUSE-SU-2026:4288-1)	Nessus	SuSE Local Security Checks	Local	high
349186	SUSE SLES15 Security Update : php-composer2 (SUSE-SU-2026:4283-1)	Nessus	SuSE Local Security Checks	Local	high
332103	openSUSE 16 Security Update : php-composer2 (openSUSE-SU-2026:21520-1)	Nessus	SuSE Local Security Checks	Local	medium
327741	SUSE SLES15 Security Update : php-composer2 (SUSE-SU-2026:3105-1)	Nessus	SuSE Local Security Checks	Local	medium
319799	Amazon Linux 2023 : composer (ALAS2023-2026-1800)	Nessus	Amazon Linux Local Security Checks	Local	high
316398	Linux Distros Unpatched Vulnerability : CVE-2026-45793	Nessus	Misc.	Local	high
442151	SCA: security update for composer/composer (GHSA-f9f8-rm49-7jv2)	Tenable Cloud Security	SCA Checks	Local	high
442151	SCA: security update for composer/composer (GHSA-f9f8-rm49-7jv2)	Tenable Self-Hosted Container Security	SCA Checks	Local	high

Detections

Analytics

CVE-2026-45793

high

Tenable Plugins

high

high

high

high

medium

medium

high

high

high

high