There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Composer is a dependency Manager for the PHP language. In affected versions several files within the local
    working directory are included during the invocation of Composer and in the context of the executing user.
    As such, under certain conditions arbitrary code execution may lead to local privilege escalation, provide
    lateral user movement or malicious code execution when Composer is invoked within a directory with
    tampered files. All Composer CLI commands are affected, including composer.phar's self-update. The
    following scenarios are of high risk: Composer being run with sudo, Pipelines which may execute Composer
    on untrusted projects, Shared environments with developers who run Composer individually on the same
    project. This vulnerability has been addressed in versions 2.7.0 and 2.2.23. It is advised that the
    patched versions are applied at the earliest convenience. Where not possible, the following should be
    addressed: Remove all sudo composer privileges for all users to mitigate root privilege escalation, and
    avoid running Composer within an untrusted directory, or if needed, verify that the contents of
    `vendor/composer/InstalledVersions.php` and `vendor/composer/installed.php` do not include untrusted code.
    A reset can also be done on these files by the following:```sh rm vendor/composer/installed.php
    vendor/composer/InstalledVersions.php composer install --no-scripts --no-plugins ``` (CVE-2024-24821)

The remote SUSE Linux SLES15 / SLES_SAP15 / openSUSE 15 host has a package installed that is affected by a vulnerability as referenced in the SUSE-SU-2024:0592-1 advisory.

    - CVE-2024-24821: Fixed potential arbitrary code execution when Composer is invoked within a directory     with tampered files (bsc#1219757).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2024-539 advisory.

    Composer is a dependency Manager for the PHP language. In affected versions several files within the local     working directory are included during the invocation of Composer and in the context of the executing user.
    As such, under certain conditions arbitrary code execution may lead to local privilege escalation, provide     lateral user movement or malicious code execution when Composer is invoked within a directory with     tampered files. All Composer CLI commands are affected, including composer.phar's self-update. The     following scenarios are of high risk: Composer being run with sudo, Pipelines which may execute Composer     on untrusted projects, Shared environments with developers who run Composer individually on the same     project. This vulnerability has been addressed in versions 2.7.0 and 2.2.23. It is advised that the     patched versions are applied at the earliest convenience. Where not possible, the following should be     addressed: Remove all sudo composer privileges for all users to mitigate root privilege escalation, and     avoid running Composer within an untrusted directory, or if needed, verify that the contents of     `vendor/composer/InstalledVersions.php` and `vendor/composer/installed.php` do not include untrusted code.
    A reset can also be done on these files by the following:```shrm vendor/composer/installed.php     vendor/composer/InstalledVersions.phpcomposer install --no-scripts --no-plugins``` (CVE-2024-24821)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the 33ba2241-c68e-11ee-9ef3-001999f8d30b advisory.

  - Composer is a dependency Manager for the PHP language. In affected versions several files within the local     working directory are included during the invocation of Composer and in the context of the executing user.
    As such, under certain conditions arbitrary code execution may lead to local privilege escalation, provide     lateral user movement or malicious code execution when Composer is invoked within a directory with     tampered files. All Composer CLI commands are affected, including composer.phar's self-update. The     following scenarios are of high risk: Composer being run with sudo, Pipelines which may execute Composer     on untrusted projects, Shared environments with developers who run Composer individually on the same     project. This vulnerability has been addressed in versions 2.7.0 and 2.2.23. It is advised that the     patched versions are applied at the earliest convenience. Where not possible, the following should be     addressed: Remove all sudo composer privileges for all users to mitigate root privilege escalation, and     avoid running Composer within an untrusted directory, or if needed, verify that the contents of     `vendor/composer/InstalledVersions.php` and `vendor/composer/installed.php` do not include untrusted code.
    A reset can also be done on these files by the following:```sh rm vendor/composer/installed.php     vendor/composer/InstalledVersions.php composer install --no-scripts --no-plugins ``` (CVE-2024-24821)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:1970-1 advisory.

    This update for php-composer2 fixes the following issues

    - CVE-2026-40176: command injection via malicious Perforce repository definition (bsc#1262254).
    - CVE-2026-40261: command injection via malicious Perforce source reference/url (bsc#1262255).

    Changes for php-composer2:

    - version update to 2.2.27 (align with upstream LTS version)
     * Security: Hardened git/hg/perforce/fossil identifier validation to ensure branch names starting with -     do      not cause issues (246f807b, 246f807b, 246f807b)
     * Security: Fixed Perforce unescaped user input in queryP4User shell command (246f807b)
     * Security: Fixed usage of insecure 3DES ciphers when ext-curl is missing (21ffece62)
     * Fixed issue handling paths with = in them on Windows (#11568)
    - version 2.2.26 2025-12-30
     * Security: Fixed ANSI sequence injection (GHSA-59pp-r3rg-353g / CVE-2025-67746)
    - version 2.2.25 2024-12-11
     * Fixed deprecation notices appearing on this LTS version in case it is used on modern PHP. Modern PHP     support      is not guaranteed nor tested for though and the main purpose of LTS releases is legacy PHP versions     support. (#12217)
     * Fixed issue on plugin upgrade when it defines multiple classes (#12226)
     * Fixed duplicate errors appearing in the output depending on php settings (#12214)
     * Fixed InstalledVersions returning duplicate data in some instances (#12225)
    - version 2.2.24 2024-06-10
     * Security: Fixed command injection via malicious git branch name (GHSA-47f6-5gq3-vx9c / CVE-2024-35241)
     * Security: Fixed multiple command injections via malicious git/hg branch names (GHSA-v9qv-c7wm-wgmf /     CVE-2024-35242)
     * Security: Fixed secure-http checks that could be bypassed by using malformed URL formats (fa3b9582c)
     * Security: Fixed Filesystem::isLocalPath including windows-specific checks on linux (3c37a67c)
     * Security: Fixed perforce argument escaping (3773f775)
     * Security: Fixed handling of zip bombs when extracting archives (de5f7e32)
     * Security: Fixed Windows command parameter escaping to prevent abuse of unicode characters with best fit     encoding
     * conversion (3130a7455, 04a63b324)
    - version 2.2.23 2024-02-08
     * Security: Fixed code execution and possible privilege escalation via compromised vendor      dir contents (GHSA-7c6p-848j-wh5h / CVE-2024-24821)
    - version 2.2.22 2023-09-29
     * Security: Fixed possible remote code execution vulnerability if composer.phar is publicly accessible,     executable as PHP,      and register_argc_argv is enabled in php.ini (GHSA-jm6m-4632-36hf / CVE-2023-43655)
     * Fixed authentication issue when downloading several files from private Bitbucket in parallel (#11464)
     * Fixed handling of broken junctions on windows (#11550)
     * Fixed loading of root aliases on path repo packages when doing partial updates (#11632)
     * Fixed parsing of lib-curl-openssl version with OSX SecureTransport (#11534)
     * Fixed binary proxies not being transparent when included by another PHP process and returning a value     (#11454)
     * Fixed support for plugin classes being marked as readonly (#11404)
     * Fixed GitHub rate limit reporting (#11366)
     * Fixed issue displaying solver problems with branch names containing % signs (#11359)
    - version 2.2.21 2023-02-15
     * Fixed extra.plugin-optional support in PluginInstaller when doing pre-install checks (#11326)
    - version 2.2.20 2023-02-10
     * Added extra.plugin-optional support for allow auto-disabling unknown plugins which are not critical     when      running non-interactive (#11315)
    - version 2.2.19 2023-02-04
     * Fixed URL sanitizer to handle new GitHub personal access tokens format (#11137)
     * Fixed cache keys to allow _ to avoid conflicts between package names like a-b and a_b (#11229)
     * Fixed handling of --ignore-platform-req with upper-bound ignores to not apply to conflict rules     (#11037)
     * Fixed handling of COMPOSER_DISCARD_CHANGES when set to 0
    - version 2.2.18 2022-08-20
     * Fixed COMPOSER_NO_DEV so it also works with require and remove's --update-no-dev (#10995)
     * Fixed duplicate missing extension warnings being displayed (#10938)
     * Fixed hg version detection (#10955)
     * Fixed git cache invalidation issue when a git tag gets created after the cache has loaded a given     reference (#11004)
    - version 2.2.17 2022-07-13
     * Fixed plugins from CWD/vendor being loaded in some cases like create-project or validate even though     the target      directory is outside of CWD (#10935)
     * Fixed support for legacy (Composer 1.x, e.g. hirak/prestissimo) plugins which will not warn/error     anymore if      not in allow-plugins, as they are anyway not loaded (#10928)
     * Fixed pre-install check for allowed plugins not taking --no-plugins into account (#10925)
     * Fixed support for disable_functions containing disk_free_space (#10936)
     * Fixed RootPackageRepository usages to always clone the root package to avoid interoperability issues     with plugins (#10940)
    - version 2.2.16 2022-07-05
     * Fixed non-interactive behavior of allow-plugins to throw instead of continue with a warning to avoid     broken installs (#10920)
     * Fixed allow-plugins BC mode to ensure old lock files created pre-2.2 can be installed with only a     warning but      plugins fully loaded (#10920)
     * Fixed deprecation notice (#10921)
    - version 2.2.15 2022-07-01
     * Fixed support for cache-read-only where the filesystem is not writable (#10906)
     * Fixed type error when using allow-plugins: true (#10909)
     * Fixed @putenv scripts receiving arguments passed to the command (#10846)
     * Fixed support for spaces in paths with binary proxies on Windows (#10836)
     * Fixed type error in GitDownloader if branches cannot be listed (#10888)
     * Fixed RootPackageInterface issue on PHP 5.3.3 (#10895)
    - version 2.2.14 2022-06-06
     * Fixed handling of broken symlinks when checking whether a package is still installed (#6708)
     * Fixed JSON schema regex pattern for name to be JS compatible (#10811)
     * Fixed bin proxies to allow a proxy to include another one safely (#10823)
     * Fixed gitlab-token JSON schema definition (#10800)
     * Fixed openssl 3.x version parsing as it is now semver compliant
     * Fixed type error when a json file cannot be read (#10818)
     * Fixed parsing of multi-line arrays in funding.yml (#10784)
    - version 2.2.13 2022-05-25
     * Fixed invalid credentials loop when setting up GitLab token (#10748)
     * Fixed PHP 8.2 deprecations (#10766)
     * Fixed lock file changes being output even when the lock file creation is disabled
     * Fixed race condition when multiple requests asking for auth on the same hostname fired concurrently     (#10763)
     * Fixed quoting of commas on Windows (#10775)
     * Fixed issue installing path repos with a disabled symlink function (#10786)
    - version 2.2.12 2022-04-13
     * Security: Fixed command injection vulnerability in HgDriver/GitDriver (GHSA-x7cr-6qr6-2hh6 /     CVE-2022-24828)
     * Fixed curl downloader not retrying when a DNS resolution failure occurs (#10716)
     * Fixed composer.lock file still being used/read when the lock config option is disabled (#10726)
     * Fixed validate command checking the lock file even if the lock option is disabled (#10723)
    - version 2.2.11 2022-04-01
     * Added missing config.bitbucket-oauth in composer-schema.json
     * Added --2.2 flag to self-update to pin the Composer version to the 2.2 LTS range (#10682)
     * Updated semver, jsonlint deps for minor fixes
     * Fixed generation of autoload crashing if a package has a broken path (#10688)
     * Removed dev-master=>dev-main alias from #10372 as it does not work when reloading from lock file and     extracting dev deps (#10651)
    - version 2.2.10 2022-03-29
     * Fixed Bitbucket authorization detection due to API changes (#10657)
     * Fixed validate command warning about dist/source keys if defined (#10655)
     * Fixed deletion/handling of corrupted 0-bytes zip archives (#10666)
    - version 2.2.9 2022-03-15
     * Fixed regression with plugins that modify install path of packages, see docs if you are authoring such     a plugin (#10621)
    - version 2.2.8 2022-03-15
     * Fixed files autoloading sort order to be fully deterministic (#10617)
     * Fixed pool optimization pass edge cases (#10579)
     * Fixed require command failing when self.version is used as constraint (#10593)
     * Fixed --no-ansi / undecorated output still showing color in repo warnings (#10601)
     * Performance improvement in pool optimization step (composer/semver#131)
    - version 2.2.7 2022-02-25
     * Allow installation together with composer/xdebug-handler ^3 (#10528)
     * Fixed support for packages with no licenses in licenses command output (#10537)
     * Fixed handling of allow-plugins: false which kept warning (#10530)
     * Fixed enum parsing in classmap generation when the enum keyword is not lowercased (#10521)
     * Fixed author parsing in init command requiring an email whereas the schema allows a name only (#10538)
     * Fixed issues in require command when requiring packages which do not exist (but are provided by     something else you require) (#10541)
     * Performance improvement in pool optimization step (#10546)
    - version 2.2.6 2022-02-04
     * BC Break: due to an oversight, the COMPOSER_BIN_DIR env var for binaries added in Composer 2.2.2 had to     be renamed      to COMPOSER_RUNTIME_BIN_DIR (#10512)
     * Fixed enum parsing in classmap generation with syntax like enum foo:string without space after :
    (#10498)
     * Fixed package search not urlencoding the input (#10500)
     * Fixed reinstall command not firing pre-install-cmd/post-install-cmd events (#10514)
     * Fixed edge case in path repositories where a symlink: true option would be ignored on old Windows and     old PHP combos (#10482)
     * Fixed test suite compatibility with latest symfony/console releases (#10499)
     * Fixed some error reporting edge cases (#10484, #10451, #10493)
    - version 2.2.5 2022-01-21
     * Disabled composer/package-versions-deprecated by default as it can function using     Composer\InstalledVersions at runtime (#10458)
     * Fixed artifact repositories crashing if a phar file was present in the directory (#10406)
     * Fixed binary proxy issue on PHP <8 when fseek is used on the proxied binary path (#10468)
     * Fixed handling of non-string versions in package repositories metadata (#10470)
    - version 2.2.4 2022-01-08
     * Fixed handling of process timeout when running async processes during installation
     * Fixed GitLab API handling when projects have a repository disabled (#10440)
     * Fixed reading of environment variables (e.g. APPDATA) containing unicode characters to workaround a PHP     bug on Windows (#10434)
     * Fixed partial update issues with path repos missing if a path repo is required by a path repo (#10431)
     * Fixed support for sourcing binaries via the new bin proxies (#10389)
     * Fixed messaging when GitHub tokens need SSO authorization (#10432)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to its self-reported version, the Tenable Security Center running on the remote host is version 6.6.0. It is, therefore, affected by multiple vulnerabilities as referenced in the TNS-2025-20 advisory.

  - Symphony process is a module for the Symphony PHP framework which executes commands in sub-processes. On     Windows, when an executable file named `cmd.exe` is located in the current working directory it will be     called by the `Process` class when preparing command arguments, leading to possible hijacking. This issue     has been addressed in release versions 5.4.46, 6.4.14, and 7.1.7. Users are advised to upgrade. There are     no known workarounds for this vulnerability. (CVE-2024-51736)

  - Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Starting     in versions 2.0.0, 5.0.0, and 6.0.0 and prior to versions 4.4.51, 5.4.31, and 6.3.8, some Twig filters in     CodeExtension use `is_safe=html` but don't actually ensure their input is safe. As of versions 4.4.51,     5.4.31, and 6.3.8, Symfony now escapes the output of the affected filters. (CVE-2023-46734)

  - The SimpleSAMLphp SAML2 library is a PHP library for SAML2 related functionality. Prior to versions 4.17.0     and 5.0.0-alpha.20, there is a signature confusion attack in the HTTPRedirect binding. An attacker with     any signed SAMLResponse via the HTTP-Redirect binding can cause the application to accept an unsigned     message. Versions 4.17.0 and 5.0.0-alpha.20 contain a fix for the issue. (CVE-2025-27773)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-7603-1 advisory.

    Thomas Chauchefoin discovered that Composer did not correctly handle certain arguments. An attacker could     possibly use this issue to execute arbitrary code. This issue only affected Ubuntu 16.04 LTS, Ubuntu 18.04     LTS, Ubuntu 20.04 LTS and Ubuntu 22.04 LTS. (CVE-2022-24828, CVE-2023-43655)

    Ed Cradock discovered that Composer did not correctly handle the exclusion of certain files. An attacker     could possibly use this issue to execute arbitrary code. This issue only affected Ubuntu 22.04 LTS.
    (CVE-2024-24821)

    Martin Haunschmid discovered that Composer did not correctly handle git branch names. An attacker could     possibly use this issue to execute arbitrary code. (CVE-2024-35241)

    Maciej Piechota discovered that Composer did not correctly handle VCS branch names. An attacker could     possibly use this issue to execute arbitrary code. (CVE-2024-35242)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
408274	Alpine: multiple composer packages: security update to 2.7.0-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	2/8/2024	7/2/2026	high
408274	Alpine: multiple composer packages: security update to 2.7.0-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	2/8/2024	7/2/2026	high
411985	SCA: security update for composer/composer (GHSA-7c6p-848j-wh5h)	Tenable Cloud Security	SCA Checks	1/23/2025	7/2/2026	high
411985	SCA: security update for composer/composer (GHSA-7c6p-848j-wh5h)	Tenable Self-Hosted Container Security	SCA Checks	1/23/2025	7/2/2026	high
190923	SUSE SLES15 / openSUSE 15 Security Update : php-composer2 (SUSE-SU-2024:0592-1)	Nessus	SuSE Local Security Checks	2/23/2024	6/26/2026	high
191593	Amazon Linux 2023 : composer (ALAS2023-2024-539)	Nessus	Amazon Linux Local Security Checks	3/6/2024	12/11/2024	high
190374	FreeBSD : Composer -- Code execution and possible privilege escalation (33ba2241-c68e-11ee-9ef3-001999f8d30b)	Nessus	FreeBSD Local Security Checks	2/9/2024	2/19/2024	high
315284	SUSE SLES15 Security Update : php-composer2 (SUSE-SU-2026:1970-1)	Nessus	SuSE Local Security Checks	5/19/2026	5/19/2026	medium
266393	Tenable Security Center Multiple Vulnerabilities (TNS-2025-20)	Nessus	Misc.	10/2/2025	10/2/2025	high
241064	Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS : Composer vulnerabilities (USN-7603-1)	Nessus	Ubuntu Local Security Checks	7/1/2025	7/1/2025	high

Detections

Analytics

Plugins Search

high

high

high

high

high

high

high

medium

high

high