Composer is a dependency Manager for the PHP language. Prior to 2.2.29 and 2.10.2, a Composer package bin entry containing .. path segments can resolve outside the package install directory and cause Composer's binary installation flow to chmod an existing host file to a world-readable and world-executable mode during composer install, update, or require. This issue is fixed in versions 2.2.29 and 2.10.2.

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-1941 advisory.

    Composer is a dependency Manager for the PHP language. Prior to 2.2.29 and 2.10.2, a Composer package bin     entry containing .. path segments can resolve outside the package install directory and cause Composer's     binary installation flow to chmod an existing host file to a world-readable and world-executable mode     during composer install, update, or require. This issue is fixed in versions 2.2.29 and 2.10.2.
    (CVE-2026-59946)

    Composer is a dependency Manager for the PHP language. Prior to 2.2.29 and 2.10.2, when Composer is run     with -vvv debug verbosity, it could print a credential embedded in the username slot of a repository or     package URL, such as a GitHub Personal Access Token in https://TOKEN@host/, to debug output because     AuthHelper, Url::sanitize, and ProcessExecutor did not sanitize username-only URL credentials. This issue     is fixed in versions 2.2.29 and 2.10.2. (CVE-2026-59947)

    Composer is a dependency Manager for the PHP language. Prior to 2.2.29 and 2.10.2, a maliciously crafted     package from an untrusted repository other than Packagist.org or Private Packagist can cause Composer to     write attacker-controlled files outside the vendor directory and outside the project during install or     update by using an invalid package name that is not correctly validated before dependency-resolution     results are written or installed. This issue is fixed in versions 2.2.29 and 2.10.2. (CVE-2026-59948)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3105-1 advisory.

    - CVE-2026-45793: Github Actions issued `GITHUB_TOKEN` disclosure in GitHub Actions logs (bsc#1271504).
    - CVE-2026-59946: path traversal in package `bin` field lets dependencies `chmod` arbitrary host files     (bsc#1271151).
    - CVE-2026-59947: URL-embedded HTTP-Basic username leaks to verbose logs  (bsc#1271129).
    - CVE-2026-59948: arbitrary file write outside `vendor`directory via malicious transitive package name     (bsc#1271122).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Composer is a dependency Manager for the PHP language. Prior to 2.2.29 and 2.10.2, a Composer package bin     entry containing .. path segments can resolve outside the package install directory and cause Composer's     binary installation flow to chmod an existing host file to a world-readable and world-executable mode     during composer install, update, or require. This issue is fixed in versions 2.2.29 and 2.10.2.
    (CVE-2026-59946)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Severity
328484	Amazon Linux 2023 : composer (ALAS2023-2026-1941)	Nessus	Amazon Linux Local Security Checks	high
327741	SUSE SLES15 Security Update : php-composer2 (SUSE-SU-2026:3105-1)	Nessus	SuSE Local Security Checks	medium
325955	Linux Distros Unpatched Vulnerability : CVE-2026-59946	Nessus	Misc.	medium

Detections

Analytics

CVE-2026-59946

medium

Tenable Plugins

high

medium

medium