Composer is a dependency Manager for the PHP language. From 1.0 until 2.2.30 and from 2.3.0 until 2.10.3, a malicious or compromised dependency can bypass the earlier CVE-2026-59946 binary-path hardening because Composer validates literal parent-directory segments only during dependency resolution, while the symlink and installed-metadata paths described by the advisory skip that validation. A package can ship an in-package binary symlink that resolves outside its installation directory, or attacker-influenced vendor/composer/installed.json metadata can provide an escaping binary path during a reinstall or regeneration of missing vendor/bin entries. The installed-metadata path is reachable only when the vendor directory was not populated by the same validated install run, such as when it is restored from an untrusted cache, copied from an earlier build stage, carried over from an older Composer run, or writable by a lower-trust build step. Composer can follow the path, change the external target's permissions to make it world-readable and executable, and create a runnable vendor/bin proxy to that external file. The issue does not directly read or transmit data and does not by itself provide remote code execution. This issue is fixed in versions 2.2.30 and 2.10.3.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Composer is a dependency Manager for the PHP language. From 1.0 until 2.2.30 and from 2.3.0 until 2.10.3,
    a malicious or compromised dependency can bypass the earlier CVE-2026-59946 binary-path hardening because
    Composer validates literal parent-directory segments only during dependency resolution, while the symlink
    and installed-metadata paths described by the advisory skip that validation. A package can ship an in-
    package binary symlink that resolves outside its installation directory, or attacker-influenced
    vendor/composer/installed.json metadata can provide an escaping binary path during a reinstall or
    regeneration of missing vendor/bin entries. The installed-metadata path is reachable only when the vendor
    directory was not populated by the same validated install run, such as when it is restored from an
    untrusted cache, copied from an earlier build stage, carried over from an older Composer run, or writable
    by a lower-trust build step. Composer can follow the path, change the external target's permissions to
    make it world-readable and executable, and create a runnable vendor/bin proxy to that external file. The
    issue does not directly read or transmit data and does not by itself provide remote code execution. This
    issue is fixed in versions 2.2.30 and 2.10.3. (CVE-2026-59944)

The remote SUSE Linux SLES16 / SLES_SAP16 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:23943-1 advisory.

    - CVE-2026-59944: path traversal and link following issue can make files world readable and executable     (bsc#1279898).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote openSUSE 16 host has a package installed that is affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21970-1 advisory.

    - CVE-2026-59944: path traversal and link following issue can make files world readable and executable     (bsc#1279898).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-3136 advisory.

    Package bin path can escape the package directory, bypassing the GHSA-gjfg-22fp-rrxx fix. A malicious or     compromised Composer package could, when installed as a dependency, cause Composer to change the     permissions of a file outside that package's own directory and to register a runnable vendor/bin command     that points at that outside file. This is a path traversal and link following issue. It is not remote code     execution, the attacker gains no ability to read or receive your data directly. The risk is that a file     which was readable only by its owner, but modifiable by Composer, can be made world readable and     executable, which is enough to expose its contents on a shared or multi tenant host. The earlier hardening     from GHSA-gjfg-22fp-rrxx can be bypassed, since it only rejected literal .. path segments in a package's     declared binaries, and was only applied in a single place during dependency resolution. (CVE-2026-59944)

    Composer is a dependency Manager for the PHP language. From 1.0 until 2.2.30 and 2.10.3, a malicious     dependency package from a custom Composer repository or an untrusted composer.lock file could set     source.type to perforce and source.url to an rsh: or jsh: P4PORT value. When the Perforce p4 client was     installed and Composer installed the package from source through composer install or composer update,     including --prefer-source, Composer\Util\Perforce passed the address to p4 without validation, causing p4     to run a local command with the privileges of the user or CI account. Packagist.org does not permit     Perforce source metadata. This issue is fixed in versions 2.2.30 and 2.10.3. (CVE-2026-84361)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:4288-1 advisory.

    - CVE-2026-59944: path traversal and link following issue can make files world readable and executable     (bsc#1279898).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:4283-1 advisory.

    - CVE-2026-45793: GitHub OAuth tokens failing regex validation can cause credential disclosure     (bsc#1271504).
    - CVE-2026-59944: path traversal and link following issue can make files world readable and executable     (bsc#1279898).
    - CVE-2026-59946: package bin entries with path segments can cause unintended host file permission     modifications       (bsc#1271152).
    - CVE-2026-59947: unsanitized URL credential handling in debug output within Composer can allow sensitive     token       disclosure (bsc#1271130).
    - CVE-2026-59948: missing package name validation during dependency resolution in Composer can allow path     traversal       (bsc#1271123).
    - CVE-2026-84361: arbitrary code execution via malicious Perforce source URL (bsc#1278257).

    Changes for php-composer2:

    - version update to 2.2.30:

     * Fixed command injection via malicious Perforce url (GHSA-rvx4-ffvw-m9q3)
     * Sanitize URL-embedded usernames/token in a few more places (#13045)
     * Fixed matching of gitlab URLs to avoid possible credential leak to the wrong domain (#13042)

    - fix a regression on s390x due last change (bsc#1271729).

    - version update to 2.2.29:

     * Validate package names (GHSA-499r-g7pc-vmp9)
     * Validate package bin paths against path traversal (GHSA-gjfg-22fp-rrxx)
     * Sanitize URL-embedded usernames/token in verbose output (GHSA-g6xq-892h-64w3)
     * Only follow HTTP redirects from HTTP responses (#12948)
     * Prevent phar metadata unserialization on unsafe PHP versions (#12946)
     * Sanitize JSON parse errors in http responses to avoid leaking response body data (#12959)
     * Fixed GitHub token validation to be even more relaxed (#12856)

    - version update to 2.2.28.

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2026-2152 advisory.

    Package bin path can escape the package directory, bypassing the GHSA-gjfg-22fp-rrxx fix. A malicious or     compromised Composer package could, when installed as a dependency, cause Composer to change the     permissions of a file outside that package's own directory and to register a runnable vendor/bin command     that points at that outside file. This is a path traversal and link following issue. It is not remote code     execution, the attacker gains no ability to read or receive your data directly. The risk is that a file     which was readable only by its owner, but modifiable by Composer, can be made world readable and     executable, which is enough to expose its contents on a shared or multi tenant host. The earlier hardening     from GHSA-gjfg-22fp-rrxx can be bypassed, since it only rejected literal .. path segments in a package's     declared binaries, and was only applied in a single place during dependency resolution. (CVE-2026-59944)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 45 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-249d41312c advisory.

    ### Version 2.10.3 - 2026-08-27

      * **Security**: Validate package bin paths against path traversal using symlinks (GHSA-96h3-5x6v-m776,     CVE-2026-59944)
      * **Security**: Fixed command injection via malicious Perforce url (GHSA-rvx4-ffvw-m9q3)
      * **Security**: Sanitize URL-embedded usernames/token in a few more places (#13044)
      * **Security**: Fixed matching of gitlab URLs to avoid possible credential leak to the wrong domain     (#12988)
      * Fixed PHP 8.6 deprecation warnings (#12967, #13028)
      * Fixed error output when a policy blocks a package version to be clearer (#12993)
      * Fixed the lock file's content-hash with a conflict marker ending up breaking at runtime (#13048)
      * Fixed possible race condition while creating directories like the cache dir when running multiple     Composer processes in parallel (#12977)
      * Fixed forgejo support to handle empty repositories better (#12968)
      * Fixed FilterListApiClient not forwarding transport options (#13040)



Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-5995821369 advisory.

    ### Version 2.10.3 - 2026-08-27

      * **Security**: Validate package bin paths against path traversal using symlinks (GHSA-96h3-5x6v-m776,     CVE-2026-59944)
      * **Security**: Fixed command injection via malicious Perforce url (GHSA-rvx4-ffvw-m9q3)
      * **Security**: Sanitize URL-embedded usernames/token in a few more places (#13044)
      * **Security**: Fixed matching of gitlab URLs to avoid possible credential leak to the wrong domain     (#12988)
      * Fixed PHP 8.6 deprecation warnings (#12967, #13028)
      * Fixed error output when a policy blocks a package version to be clearer (#12993)
      * Fixed the lock file's content-hash with a conflict marker ending up breaking at runtime (#13048)
      * Fixed possible race condition while creating directories like the cache dir when running multiple     Composer processes in parallel (#12977)
      * Fixed forgejo support to handle empty repositories better (#12968)
      * Fixed FilterListApiClient not forwarding transport options (#13040)



Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-0425df0537 advisory.

    ### Version 2.10.3 - 2026-08-27

      * **Security**: Validate package bin paths against path traversal using symlinks (GHSA-96h3-5x6v-m776,     CVE-2026-59944)
      * **Security**: Fixed command injection via malicious Perforce url (GHSA-rvx4-ffvw-m9q3)
      * **Security**: Sanitize URL-embedded usernames/token in a few more places (#13044)
      * **Security**: Fixed matching of gitlab URLs to avoid possible credential leak to the wrong domain     (#12988)
      * Fixed PHP 8.6 deprecation warnings (#12967, #13028)
      * Fixed error output when a policy blocks a package version to be clearer (#12993)
      * Fixed the lock file's content-hash with a conflict marker ending up breaking at runtime (#13048)
      * Fixed possible race condition while creating directories like the cache dir when running multiple     Composer processes in parallel (#12977)
      * Fixed forgejo support to handle empty repositories better (#12968)
      * Fixed FilterListApiClient not forwarding transport options (#13040)



Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Composer is a dependency Manager for the PHP language. From 1.0 until 2.2.30 and from 2.3.0 until 2.10.3,     a malicious or compromised dependency can bypass the earlier CVE-2026-59946 binary-path hardening because     Composer validates literal parent-directory segments only during dependency resolution, while the symlink     and installed-metadata paths described by the advisory skip that validation. A package can ship an in-     package binary symlink that resolves outside its installation directory, or attacker-influenced     vendor/composer/installed.json metadata can provide an escaping binary path during a reinstall or     regeneration of missing vendor/bin entries. The installed-metadata path is reachable only when the vendor     directory was not populated by the same validated install run, such as when it is restored from an     untrusted cache, copied from an earlier build stage, carried over from an older Composer run, or writable     by a lower-trust build step. Composer can follow the path, change the external target's permissions to     make it world-readable and executable, and create a runnable vendor/bin proxy to that external file. The     issue does not directly read or transmit data and does not by itself provide remote code execution. This     issue is fixed in versions 2.2.30 and 2.10.3. (CVE-2026-59944)

Note that Nessus relies on the presence of the package as reported by the vendor.

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the db135cd1-a232-11f1-85ed-10ffe07f9334 advisory.

    Composer project reports:
    Validate package bin paths against path traversal using symlinks (GHSA-96h3-5x6v-m776, CVE-2026-59944)     Fixed command injection via malicious Perforce url (GHSA-rvx4-ffvw-m9q3)

Tenable has extracted the preceding description block directly from the FreeBSD security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Type	Severity
471971	SCA: security update for composer/composer (GHSA-96h3-5x6v-m776)	Tenable Cloud Security	SCA Checks	Local	medium
471971	SCA: security update for composer/composer (GHSA-96h3-5x6v-m776)	Tenable Self-Hosted Container Security	SCA Checks	Local	medium
362582	SUSE SLES16 Security Update : php-composer2 (SUSE-SU-2026:23943-1)	Nessus	SuSE Local Security Checks	Local	high
362504	openSUSE 16 Security Update : php-composer2 (openSUSE-SU-2026:21970-1)	Nessus	SuSE Local Security Checks	Local	high
351112	Amazon Linux 2023 : composer (ALAS2023-2026-3136)	Nessus	Amazon Linux Local Security Checks	Local	high
349191	SUSE SLES15 Security Update : php-composer2 (SUSE-SU-2026:4288-1)	Nessus	SuSE Local Security Checks	Local	high
349186	SUSE SLES15 Security Update : php-composer2 (SUSE-SU-2026:4283-1)	Nessus	SuSE Local Security Checks	Local	high
345803	Amazon Linux 2023 : composer (ALAS2023-2026-2152)	Nessus	Amazon Linux Local Security Checks	Local	medium
344878	Fedora 45 : composer (2026-249d41312c)	Nessus	Fedora Local Security Checks	Local	high
343055	Fedora 44 : composer (2026-5995821369)	Nessus	Fedora Local Security Checks	Local	high
342928	Fedora 43 : composer (2026-0425df0537)	Nessus	Fedora Local Security Checks	Local	high
341539	Linux Distros Unpatched Vulnerability : CVE-2026-59944	Nessus	Misc.	Local	medium
341196	FreeBSD : PHP Composer -- Multiple vulnerabilities (db135cd1-a232-11f1-85ed-10ffe07f9334)	Nessus	FreeBSD Local Security Checks	Local	medium

Detections

Analytics

CVE-2026-59944

medium

Tenable Plugins

medium

medium

high

high

high

high

high

medium

high

high

high

medium

medium