Composer is a dependency Manager for the PHP language. From 1.0 until 2.2.30 and 2.10.3, a malicious dependency package from a custom Composer repository or an untrusted composer.lock file could set source.type to perforce and source.url to an rsh: or jsh: P4PORT value. When the Perforce p4 client was installed and Composer installed the package from source through composer install or composer update, including --prefer-source, Composer\Util\Perforce passed the address to p4 without validation, causing p4 to run a local command with the privileges of the user or CI account. Packagist.org does not permit Perforce source metadata. This issue is fixed in versions 2.2.30 and 2.10.3.

The remote SUSE Linux SLES15 / SLES_SAP15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:4283-1 advisory.

    - CVE-2026-45793: GitHub OAuth tokens failing regex validation can cause credential disclosure     (bsc#1271504).
    - CVE-2026-59944: path traversal and link following issue can make files world readable and executable     (bsc#1279898).
    - CVE-2026-59946: package bin entries with path segments can cause unintended host file permission     modifications       (bsc#1271152).
    - CVE-2026-59947: unsanitized URL credential handling in debug output within Composer can allow sensitive     token       disclosure (bsc#1271130).
    - CVE-2026-59948: missing package name validation during dependency resolution in Composer can allow path     traversal       (bsc#1271123).
    - CVE-2026-84361: arbitrary code execution via malicious Perforce source URL (bsc#1278257).

    Changes for php-composer2:

    - version update to 2.2.30:

     * Fixed command injection via malicious Perforce url (GHSA-rvx4-ffvw-m9q3)
     * Sanitize URL-embedded usernames/token in a few more places (#13045)
     * Fixed matching of gitlab URLs to avoid possible credential leak to the wrong domain (#13042)

    - fix a regression on s390x due last change (bsc#1271729).

    - version update to 2.2.29:

     * Validate package names (GHSA-499r-g7pc-vmp9)
     * Validate package bin paths against path traversal (GHSA-gjfg-22fp-rrxx)
     * Sanitize URL-embedded usernames/token in verbose output (GHSA-g6xq-892h-64w3)
     * Only follow HTTP redirects from HTTP responses (#12948)
     * Prevent phar metadata unserialization on unsafe PHP versions (#12946)
     * Sanitize JSON parse errors in http responses to avoid leaking response body data (#12959)
     * Fixed GitHub token validation to be even more relaxed (#12856)

    - version update to 2.2.28.

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has a package installed that is affected by a vulnerability as referenced in the SUSE-SU-2026:4059-1 advisory.

    This update for php-composer2 fixes the following issue:

    - CVE-2026-84361: Arbitrary code execution via malicious Perforce source URL (bsc#1278257).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 45 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-249d41312c advisory.

    ### Version 2.10.3 - 2026-08-27

      * **Security**: Validate package bin paths against path traversal using symlinks (GHSA-96h3-5x6v-m776,     CVE-2026-59944)
      * **Security**: Fixed command injection via malicious Perforce url (GHSA-rvx4-ffvw-m9q3)
      * **Security**: Sanitize URL-embedded usernames/token in a few more places (#13044)
      * **Security**: Fixed matching of gitlab URLs to avoid possible credential leak to the wrong domain     (#12988)
      * Fixed PHP 8.6 deprecation warnings (#12967, #13028)
      * Fixed error output when a policy blocks a package version to be clearer (#12993)
      * Fixed the lock file's content-hash with a conflict marker ending up breaking at runtime (#13048)
      * Fixed possible race condition while creating directories like the cache dir when running multiple     Composer processes in parallel (#12977)
      * Fixed forgejo support to handle empty repositories better (#12968)
      * Fixed FilterListApiClient not forwarding transport options (#13040)



Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote openSUSE 16 host has a package installed that is affected by a vulnerability as referenced in the openSUSE- SU-2026:21778-1 advisory.

    This update for php-composer2 fixes the following issue:

    - CVE-2026-84361: Arbitrary code execution via malicious Perforce source URL (bsc#1278257).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-5995821369 advisory.

    ### Version 2.10.3 - 2026-08-27

      * **Security**: Validate package bin paths against path traversal using symlinks (GHSA-96h3-5x6v-m776,     CVE-2026-59944)
      * **Security**: Fixed command injection via malicious Perforce url (GHSA-rvx4-ffvw-m9q3)
      * **Security**: Sanitize URL-embedded usernames/token in a few more places (#13044)
      * **Security**: Fixed matching of gitlab URLs to avoid possible credential leak to the wrong domain     (#12988)
      * Fixed PHP 8.6 deprecation warnings (#12967, #13028)
      * Fixed error output when a policy blocks a package version to be clearer (#12993)
      * Fixed the lock file's content-hash with a conflict marker ending up breaking at runtime (#13048)
      * Fixed possible race condition while creating directories like the cache dir when running multiple     Composer processes in parallel (#12977)
      * Fixed forgejo support to handle empty repositories better (#12968)
      * Fixed FilterListApiClient not forwarding transport options (#13040)



Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-0425df0537 advisory.

    ### Version 2.10.3 - 2026-08-27

      * **Security**: Validate package bin paths against path traversal using symlinks (GHSA-96h3-5x6v-m776,     CVE-2026-59944)
      * **Security**: Fixed command injection via malicious Perforce url (GHSA-rvx4-ffvw-m9q3)
      * **Security**: Sanitize URL-embedded usernames/token in a few more places (#13044)
      * **Security**: Fixed matching of gitlab URLs to avoid possible credential leak to the wrong domain     (#12988)
      * Fixed PHP 8.6 deprecation warnings (#12967, #13028)
      * Fixed error output when a policy blocks a package version to be clearer (#12993)
      * Fixed the lock file's content-hash with a conflict marker ending up breaking at runtime (#13048)
      * Fixed possible race condition while creating directories like the cache dir when running multiple     Composer processes in parallel (#12977)
      * Fixed forgejo support to handle empty repositories better (#12968)
      * Fixed FilterListApiClient not forwarding transport options (#13040)



Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Composer is a dependency Manager for the PHP language. From 1.0 until 2.2.30 and 2.10.3, a malicious     dependency package from a custom Composer repository or an untrusted composer.lock file could set     source.type to perforce and source.url to an rsh: or jsh: P4PORT value. When the Perforce p4 client was     installed and Composer installed the package from source through composer install or composer update,     including --prefer-source, Composer\Util\Perforce passed the address to p4 without validation, causing p4     to run a local command with the privileges of the user or CI account. Packagist.org does not permit     Perforce source metadata. This issue is fixed in versions 2.2.30 and 2.10.3. (CVE-2026-84361)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
349186	SUSE SLES15 Security Update : php-composer2 (SUSE-SU-2026:4283-1)	Nessus	SuSE Local Security Checks	Local	high
348471	SUSE SLES15 Security Update : php-composer2 (SUSE-SU-2026:4059-1)	Nessus	SuSE Local Security Checks	Local	high
344878	Fedora 45 : composer (2026-249d41312c)	Nessus	Fedora Local Security Checks	Local	high
343956	openSUSE 16 Security Update : php-composer2 (openSUSE-SU-2026:21778-1)	Nessus	SuSE Local Security Checks	Local	high
343055	Fedora 44 : composer (2026-5995821369)	Nessus	Fedora Local Security Checks	Local	high
342928	Fedora 43 : composer (2026-0425df0537)	Nessus	Fedora Local Security Checks	Local	high
342504	Linux Distros Unpatched Vulnerability : CVE-2026-84361	Nessus	Misc.	Local	high

Detections

Analytics

CVE-2026-84361

high

Tenable Plugins

high

high

high

high

high

high

high