There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:

  - Composer is a dependency Manager for the PHP language. From 1.0 until 2.2.30 and from 2.3.0 until 2.10.3,
    a malicious or compromised dependency can bypass the earlier CVE-2026-59946 binary-path hardening because
    Composer validates literal parent-directory segments only during dependency resolution, while the symlink
    and installed-metadata paths described by the advisory skip that validation. A package can ship an in-
    package binary symlink that resolves outside its installation directory, or attacker-influenced
    vendor/composer/installed.json metadata can provide an escaping binary path during a reinstall or
    regeneration of missing vendor/bin entries. The installed-metadata path is reachable only when the vendor
    directory was not populated by the same validated install run, such as when it is restored from an
    untrusted cache, copied from an earlier build stage, carried over from an older Composer run, or writable
    by a lower-trust build step. Composer can follow the path, change the external target's permissions to
    make it world-readable and executable, and create a runnable vendor/bin proxy to that external file. The
    issue does not directly read or transmit data and does not by itself provide remote code execution. This
    issue is fixed in versions 2.2.30 and 2.10.3. (CVE-2026-59944)

  - Composer is a dependency Manager for the PHP language. From 1.0 until 2.2.30 and 2.10.3, a malicious
    dependency package from a custom Composer repository or an untrusted composer.lock file could set
    source.type to perforce and source.url to an rsh: or jsh: P4PORT value. When the Perforce p4 client was
    installed and Composer installed the package from source through composer install or composer update,
    including --prefer-source, Composer\Util\Perforce passed the address to p4 without validation, causing p4
    to run a local command with the privileges of the user or CI account. Packagist.org does not permit
    Perforce source metadata. This issue is fixed in versions 2.2.30 and 2.10.3. (CVE-2026-84361)

The remote SUSE Linux SLES15 / SLES_SAP15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:4283-1 advisory.

    - CVE-2026-45793: GitHub OAuth tokens failing regex validation can cause credential disclosure     (bsc#1271504).
    - CVE-2026-59944: path traversal and link following issue can make files world readable and executable     (bsc#1279898).
    - CVE-2026-59946: package bin entries with path segments can cause unintended host file permission     modifications       (bsc#1271152).
    - CVE-2026-59947: unsanitized URL credential handling in debug output within Composer can allow sensitive     token       disclosure (bsc#1271130).
    - CVE-2026-59948: missing package name validation during dependency resolution in Composer can allow path     traversal       (bsc#1271123).
    - CVE-2026-84361: arbitrary code execution via malicious Perforce source URL (bsc#1278257).

    Changes for php-composer2:

    - version update to 2.2.30:

     * Fixed command injection via malicious Perforce url (GHSA-rvx4-ffvw-m9q3)
     * Sanitize URL-embedded usernames/token in a few more places (#13045)
     * Fixed matching of gitlab URLs to avoid possible credential leak to the wrong domain (#13042)

    - fix a regression on s390x due last change (bsc#1271729).

    - version update to 2.2.29:

     * Validate package names (GHSA-499r-g7pc-vmp9)
     * Validate package bin paths against path traversal (GHSA-gjfg-22fp-rrxx)
     * Sanitize URL-embedded usernames/token in verbose output (GHSA-g6xq-892h-64w3)
     * Only follow HTTP redirects from HTTP responses (#12948)
     * Prevent phar metadata unserialization on unsafe PHP versions (#12946)
     * Sanitize JSON parse errors in http responses to avoid leaking response body data (#12959)
     * Fixed GitHub token validation to be even more relaxed (#12856)

    - version update to 2.2.28.

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has a package installed that is affected by a vulnerability as referenced in the SUSE-SU-2026:4059-1 advisory.

    This update for php-composer2 fixes the following issue:

    - CVE-2026-84361: Arbitrary code execution via malicious Perforce source URL (bsc#1278257).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 45 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-249d41312c advisory.

    ### Version 2.10.3 - 2026-08-27

      * **Security**: Validate package bin paths against path traversal using symlinks (GHSA-96h3-5x6v-m776,     CVE-2026-59944)
      * **Security**: Fixed command injection via malicious Perforce url (GHSA-rvx4-ffvw-m9q3)
      * **Security**: Sanitize URL-embedded usernames/token in a few more places (#13044)
      * **Security**: Fixed matching of gitlab URLs to avoid possible credential leak to the wrong domain     (#12988)
      * Fixed PHP 8.6 deprecation warnings (#12967, #13028)
      * Fixed error output when a policy blocks a package version to be clearer (#12993)
      * Fixed the lock file's content-hash with a conflict marker ending up breaking at runtime (#13048)
      * Fixed possible race condition while creating directories like the cache dir when running multiple     Composer processes in parallel (#12977)
      * Fixed forgejo support to handle empty repositories better (#12968)
      * Fixed FilterListApiClient not forwarding transport options (#13040)



Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-3136 advisory.

    Package bin path can escape the package directory, bypassing the GHSA-gjfg-22fp-rrxx fix. A malicious or     compromised Composer package could, when installed as a dependency, cause Composer to change the     permissions of a file outside that package's own directory and to register a runnable vendor/bin command     that points at that outside file. This is a path traversal and link following issue. It is not remote code     execution, the attacker gains no ability to read or receive your data directly. The risk is that a file     which was readable only by its owner, but modifiable by Composer, can be made world readable and     executable, which is enough to expose its contents on a shared or multi tenant host. The earlier hardening     from GHSA-gjfg-22fp-rrxx can be bypassed, since it only rejected literal .. path segments in a package's     declared binaries, and was only applied in a single place during dependency resolution. (CVE-2026-59944)

    Composer is a dependency Manager for the PHP language. From 1.0 until 2.2.30 and 2.10.3, a malicious     dependency package from a custom Composer repository or an untrusted composer.lock file could set     source.type to perforce and source.url to an rsh: or jsh: P4PORT value. When the Perforce p4 client was     installed and Composer installed the package from source through composer install or composer update,     including --prefer-source, Composer\Util\Perforce passed the address to p4 without validation, causing p4     to run a local command with the privileges of the user or CI account. Packagist.org does not permit     Perforce source metadata. This issue is fixed in versions 2.2.30 and 2.10.3. (CVE-2026-84361)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Composer is a dependency Manager for the PHP language. From 1.0 until 2.2.30 and 2.10.3, a malicious     dependency package from a custom Composer repository or an untrusted composer.lock file could set     source.type to perforce and source.url to an rsh: or jsh: P4PORT value. When the Perforce p4 client was     installed and Composer installed the package from source through composer install or composer update,     including --prefer-source, Composer\Util\Perforce passed the address to p4 without validation, causing p4     to run a local command with the privileges of the user or CI account. Packagist.org does not permit     Perforce source metadata. This issue is fixed in versions 2.2.30 and 2.10.3. (CVE-2026-84361)

Note that Nessus relies on the presence of the package as reported by the vendor.

The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-0425df0537 advisory.

    ### Version 2.10.3 - 2026-08-27

      * **Security**: Validate package bin paths against path traversal using symlinks (GHSA-96h3-5x6v-m776,     CVE-2026-59944)
      * **Security**: Fixed command injection via malicious Perforce url (GHSA-rvx4-ffvw-m9q3)
      * **Security**: Sanitize URL-embedded usernames/token in a few more places (#13044)
      * **Security**: Fixed matching of gitlab URLs to avoid possible credential leak to the wrong domain     (#12988)
      * Fixed PHP 8.6 deprecation warnings (#12967, #13028)
      * Fixed error output when a policy blocks a package version to be clearer (#12993)
      * Fixed the lock file's content-hash with a conflict marker ending up breaking at runtime (#13048)
      * Fixed possible race condition while creating directories like the cache dir when running multiple     Composer processes in parallel (#12977)
      * Fixed forgejo support to handle empty repositories better (#12968)
      * Fixed FilterListApiClient not forwarding transport options (#13040)



Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-5995821369 advisory.

    ### Version 2.10.3 - 2026-08-27

      * **Security**: Validate package bin paths against path traversal using symlinks (GHSA-96h3-5x6v-m776,     CVE-2026-59944)
      * **Security**: Fixed command injection via malicious Perforce url (GHSA-rvx4-ffvw-m9q3)
      * **Security**: Sanitize URL-embedded usernames/token in a few more places (#13044)
      * **Security**: Fixed matching of gitlab URLs to avoid possible credential leak to the wrong domain     (#12988)
      * Fixed PHP 8.6 deprecation warnings (#12967, #13028)
      * Fixed error output when a policy blocks a package version to be clearer (#12993)
      * Fixed the lock file's content-hash with a conflict marker ending up breaking at runtime (#13048)
      * Fixed possible race condition while creating directories like the cache dir when running multiple     Composer processes in parallel (#12977)
      * Fixed forgejo support to handle empty repositories better (#12968)
      * Fixed FilterListApiClient not forwarding transport options (#13040)



Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote openSUSE 16 host has a package installed that is affected by a vulnerability as referenced in the openSUSE- SU-2026:21778-1 advisory.

    This update for php-composer2 fixes the following issue:

    - CVE-2026-84361: Arbitrary code execution via malicious Perforce source URL (bsc#1278257).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
476571	Alpine: multiple composer packages: security update to 2.10.3-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	10/22/2026	10/22/2026	high
476571	Alpine: multiple composer packages: security update to 2.10.3-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	10/22/2026	10/22/2026	high
349186	SUSE SLES15 Security Update : php-composer2 (SUSE-SU-2026:4283-1)	Nessus	SuSE Local Security Checks	9/23/2026	9/24/2026	high
348471	SUSE SLES15 Security Update : php-composer2 (SUSE-SU-2026:4059-1)	Nessus	SuSE Local Security Checks	9/21/2026	9/24/2026	high
344878	Fedora 45 : composer (2026-249d41312c)	Nessus	Fedora Local Security Checks	9/11/2026	9/24/2026	high
351112	Amazon Linux 2023 : composer (ALAS2023-2026-3136)	Nessus	Amazon Linux Local Security Checks	9/29/2026	9/29/2026	high
342504	Linux Distros Unpatched Vulnerability : CVE-2026-84361	Nessus	Misc.	9/3/2026	10/30/2026	high
342928	Fedora 43 : composer (2026-0425df0537)	Nessus	Fedora Local Security Checks	9/4/2026	9/24/2026	high
343055	Fedora 44 : composer (2026-5995821369)	Nessus	Fedora Local Security Checks	9/5/2026	9/24/2026	high
343956	openSUSE 16 Security Update : php-composer2 (openSUSE-SU-2026:21778-1)	Nessus	SuSE Local Security Checks	9/9/2026	9/24/2026	high

Detections

Analytics

Plugins Search

high

high

high

high

high

high

high

high

high

high