Composer is a dependency Manager for the PHP language. Prior to 2.2.29 and 2.10.2, a Composer package bin entry containing .. path segments can resolve outside the package install directory and cause Composer's binary installation flow to chmod an existing host file to a world-readable and world-executable mode during composer install, update, or require. This issue is fixed in versions 2.2.29 and 2.10.2.

The remote SUSE Linux SLES15 / SLES_SAP15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:4283-1 advisory.

    - CVE-2026-45793: GitHub OAuth tokens failing regex validation can cause credential disclosure     (bsc#1271504).
    - CVE-2026-59944: path traversal and link following issue can make files world readable and executable     (bsc#1279898).
    - CVE-2026-59946: package bin entries with path segments can cause unintended host file permission     modifications       (bsc#1271152).
    - CVE-2026-59947: unsanitized URL credential handling in debug output within Composer can allow sensitive     token       disclosure (bsc#1271130).
    - CVE-2026-59948: missing package name validation during dependency resolution in Composer can allow path     traversal       (bsc#1271123).
    - CVE-2026-84361: arbitrary code execution via malicious Perforce source URL (bsc#1278257).

    Changes for php-composer2:

    - version update to 2.2.30:

     * Fixed command injection via malicious Perforce url (GHSA-rvx4-ffvw-m9q3)
     * Sanitize URL-embedded usernames/token in a few more places (#13045)
     * Fixed matching of gitlab URLs to avoid possible credential leak to the wrong domain (#13042)

    - fix a regression on s390x due last change (bsc#1271729).

    - version update to 2.2.29:

     * Validate package names (GHSA-499r-g7pc-vmp9)
     * Validate package bin paths against path traversal (GHSA-gjfg-22fp-rrxx)
     * Sanitize URL-embedded usernames/token in verbose output (GHSA-g6xq-892h-64w3)
     * Only follow HTTP redirects from HTTP responses (#12948)
     * Prevent phar metadata unserialization on unsafe PHP versions (#12946)
     * Sanitize JSON parse errors in http responses to avoid leaking response body data (#12959)
     * Fixed GitHub token validation to be even more relaxed (#12856)

    - version update to 2.2.28.

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote openSUSE 16 host has a package installed that is affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21520-1 advisory.

    - CVE-2026-45793: Github Actions issued `GITHUB_TOKEN` disclosure in GitHub Actions logs (bsc#1271504).
    - CVE-2026-59946: path traversal in package `bin` field lets dependencies `chmod` arbitrary host files     (bsc#1271151).
    - CVE-2026-59947: URL-embedded HTTP-Basic username leaks to verbose logs  (bsc#1271129).
    - CVE-2026-59948: arbitrary file write outside `vendor`directory via malicious transitive package name     (bsc#1271122).

    Changes for php-composer2:

    - fix byte-swapped signature on s390x can cause broken or unsupported signature (bsc#1271729).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-1941 advisory.

    Composer is a dependency Manager for the PHP language. Prior to 2.2.29 and 2.10.2, a Composer package bin     entry containing .. path segments can resolve outside the package install directory and cause Composer's     binary installation flow to chmod an existing host file to a world-readable and world-executable mode     during composer install, update, or require. This issue is fixed in versions 2.2.29 and 2.10.2.
    (CVE-2026-59946)

    Composer is a dependency Manager for the PHP language. Prior to 2.2.29 and 2.10.2, when Composer is run     with -vvv debug verbosity, it could print a credential embedded in the username slot of a repository or     package URL, such as a GitHub Personal Access Token in https://TOKEN@host/, to debug output because     AuthHelper, Url::sanitize, and ProcessExecutor did not sanitize username-only URL credentials. This issue     is fixed in versions 2.2.29 and 2.10.2. (CVE-2026-59947)

    Composer is a dependency Manager for the PHP language. Prior to 2.2.29 and 2.10.2, a maliciously crafted     package from an untrusted repository other than Packagist.org or Private Packagist can cause Composer to     write attacker-controlled files outside the vendor directory and outside the project during install or     update by using an invalid package name that is not correctly validated before dependency-resolution     results are written or installed. This issue is fixed in versions 2.2.29 and 2.10.2. (CVE-2026-59948)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3105-1 advisory.

    - CVE-2026-45793: Github Actions issued `GITHUB_TOKEN` disclosure in GitHub Actions logs (bsc#1271504).
    - CVE-2026-59946: path traversal in package `bin` field lets dependencies `chmod` arbitrary host files     (bsc#1271151).
    - CVE-2026-59947: URL-embedded HTTP-Basic username leaks to verbose logs  (bsc#1271129).
    - CVE-2026-59948: arbitrary file write outside `vendor`directory via malicious transitive package name     (bsc#1271122).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Composer is a dependency Manager for the PHP language. Prior to 2.2.29 and 2.10.2, a Composer package bin     entry containing .. path segments can resolve outside the package install directory and cause Composer's     binary installation flow to chmod an existing host file to a world-readable and world-executable mode     during composer install, update, or require. This issue is fixed in versions 2.2.29 and 2.10.2.
    (CVE-2026-59946)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
349186	SUSE SLES15 Security Update : php-composer2 (SUSE-SU-2026:4283-1)	Nessus	SuSE Local Security Checks	Local	high
332103	openSUSE 16 Security Update : php-composer2 (openSUSE-SU-2026:21520-1)	Nessus	SuSE Local Security Checks	Local	medium
328484	Amazon Linux 2023 : composer (ALAS2023-2026-1941)	Nessus	Amazon Linux Local Security Checks	Local	high
327741	SUSE SLES15 Security Update : php-composer2 (SUSE-SU-2026:3105-1)	Nessus	SuSE Local Security Checks	Local	medium
325955	Linux Distros Unpatched Vulnerability : CVE-2026-59946	Nessus	Misc.	Local	medium

Detections

Analytics

CVE-2026-59946

medium

Tenable Plugins

high

medium

high

medium

medium