Composer is a dependency Manager for the PHP language. From 1.0 until 2.2.30 and from 2.3.0 until 2.10.3, a malicious or compromised dependency can bypass the earlier CVE-2026-59946 binary-path hardening because Composer validates literal parent-directory segments only during dependency resolution, while the symlink and installed-metadata paths described by the advisory skip that validation. A package can ship an in-package binary symlink that resolves outside its installation directory, or attacker-influenced vendor/composer/installed.json metadata can provide an escaping binary path during a reinstall or regeneration of missing vendor/bin entries. The installed-metadata path is reachable only when the vendor directory was not populated by the same validated install run, such as when it is restored from an untrusted cache, copied from an earlier build stage, carried over from an older Composer run, or writable by a lower-trust build step. Composer can follow the path, change the external target's permissions to make it world-readable and executable, and create a runnable vendor/bin proxy to that external file. The issue does not directly read or transmit data and does not by itself provide remote code execution. This issue is fixed in versions 2.2.30 and 2.10.3.

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2026-2152 advisory.

    Package bin path can escape the package directory, bypassing the GHSA-gjfg-22fp-rrxx fix. A malicious or     compromised Composer package could, when installed as a dependency, cause Composer to change the     permissions of a file outside that package's own directory and to register a runnable vendor/bin command     that points at that outside file. This is a path traversal and link following issue. It is not remote code     execution, the attacker gains no ability to read or receive your data directly. The risk is that a file     which was readable only by its owner, but modifiable by Composer, can be made world readable and     executable, which is enough to expose its contents on a shared or multi tenant host. The earlier hardening     from GHSA-gjfg-22fp-rrxx can be bypassed, since it only rejected literal .. path segments in a package's     declared binaries, and was only applied in a single place during dependency resolution. (CVE-2026-59944)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 45 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-249d41312c advisory.

    ### Version 2.10.3 - 2026-08-27

      * **Security**: Validate package bin paths against path traversal using symlinks (GHSA-96h3-5x6v-m776,     CVE-2026-59944)
      * **Security**: Fixed command injection via malicious Perforce url (GHSA-rvx4-ffvw-m9q3)
      * **Security**: Sanitize URL-embedded usernames/token in a few more places (#13044)
      * **Security**: Fixed matching of gitlab URLs to avoid possible credential leak to the wrong domain     (#12988)
      * Fixed PHP 8.6 deprecation warnings (#12967, #13028)
      * Fixed error output when a policy blocks a package version to be clearer (#12993)
      * Fixed the lock file's content-hash with a conflict marker ending up breaking at runtime (#13048)
      * Fixed possible race condition while creating directories like the cache dir when running multiple     Composer processes in parallel (#12977)
      * Fixed forgejo support to handle empty repositories better (#12968)
      * Fixed FilterListApiClient not forwarding transport options (#13040)



Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-5995821369 advisory.

    ### Version 2.10.3 - 2026-08-27

      * **Security**: Validate package bin paths against path traversal using symlinks (GHSA-96h3-5x6v-m776,     CVE-2026-59944)
      * **Security**: Fixed command injection via malicious Perforce url (GHSA-rvx4-ffvw-m9q3)
      * **Security**: Sanitize URL-embedded usernames/token in a few more places (#13044)
      * **Security**: Fixed matching of gitlab URLs to avoid possible credential leak to the wrong domain     (#12988)
      * Fixed PHP 8.6 deprecation warnings (#12967, #13028)
      * Fixed error output when a policy blocks a package version to be clearer (#12993)
      * Fixed the lock file's content-hash with a conflict marker ending up breaking at runtime (#13048)
      * Fixed possible race condition while creating directories like the cache dir when running multiple     Composer processes in parallel (#12977)
      * Fixed forgejo support to handle empty repositories better (#12968)
      * Fixed FilterListApiClient not forwarding transport options (#13040)



Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-0425df0537 advisory.

    ### Version 2.10.3 - 2026-08-27

      * **Security**: Validate package bin paths against path traversal using symlinks (GHSA-96h3-5x6v-m776,     CVE-2026-59944)
      * **Security**: Fixed command injection via malicious Perforce url (GHSA-rvx4-ffvw-m9q3)
      * **Security**: Sanitize URL-embedded usernames/token in a few more places (#13044)
      * **Security**: Fixed matching of gitlab URLs to avoid possible credential leak to the wrong domain     (#12988)
      * Fixed PHP 8.6 deprecation warnings (#12967, #13028)
      * Fixed error output when a policy blocks a package version to be clearer (#12993)
      * Fixed the lock file's content-hash with a conflict marker ending up breaking at runtime (#13048)
      * Fixed possible race condition while creating directories like the cache dir when running multiple     Composer processes in parallel (#12977)
      * Fixed forgejo support to handle empty repositories better (#12968)
      * Fixed FilterListApiClient not forwarding transport options (#13040)



Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Composer is a dependency Manager for the PHP language. From 1.0 until 2.2.30 and from 2.3.0 until 2.10.3,     a malicious or compromised dependency can bypass the earlier CVE-2026-59946 binary-path hardening because     Composer validates literal parent-directory segments only during dependency resolution, while the symlink     and installed-metadata paths described by the advisory skip that validation. A package can ship an in-     package binary symlink that resolves outside its installation directory, or attacker-influenced     vendor/composer/installed.json metadata can provide an escaping binary path during a reinstall or     regeneration of missing vendor/bin entries. The installed-metadata path is reachable only when the vendor     directory was not populated by the same validated install run, such as when it is restored from an     untrusted cache, copied from an earlier build stage, carried over from an older Composer run, or writable     by a lower-trust build step. Composer can follow the path, change the external target's permissions to     make it world-readable and executable, and create a runnable vendor/bin proxy to that external file. The     issue does not directly read or transmit data and does not by itself provide remote code execution. This     issue is fixed in versions 2.2.30 and 2.10.3. (CVE-2026-59944)

Note that Nessus relies on the presence of the package as reported by the vendor.

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the db135cd1-a232-11f1-85ed-10ffe07f9334 advisory.

    Composer project reports:
    Validate package bin paths against path traversal using symlinks (GHSA-96h3-5x6v-m776, CVE-2026-59944)     Fixed command injection via malicious Perforce url (GHSA-rvx4-ffvw-m9q3)

Tenable has extracted the preceding description block directly from the FreeBSD security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Type	Severity
345803	Amazon Linux 2023 : composer (ALAS2023-2026-2152)	Nessus	Amazon Linux Local Security Checks	Local	medium
344878	Fedora 45 : composer (2026-249d41312c)	Nessus	Fedora Local Security Checks	Local	high
343055	Fedora 44 : composer (2026-5995821369)	Nessus	Fedora Local Security Checks	Local	high
342928	Fedora 43 : composer (2026-0425df0537)	Nessus	Fedora Local Security Checks	Local	high
341539	Linux Distros Unpatched Vulnerability : CVE-2026-59944	Nessus	Misc.	Local	medium
341196	FreeBSD : PHP Composer -- Multiple vulnerabilities (db135cd1-a232-11f1-85ed-10ffe07f9334)	Nessus	FreeBSD Local Security Checks	Local	medium

Detections

Analytics

CVE-2026-59944

medium

Tenable Plugins

medium

high

high

high

medium

medium