A serious vulnerability has been discovered in Composer, the popular PHP dependency manager, that could allow malicious or hijacked packages to change permissions on files outside their own installation paths. This security issue, tracked as CVE-2026-59944, poses a particular risk for shared or multi-tenant server environments when unsafe binary paths are processed. Composer versions from 2.3.0 up to (but not including) 2.10.3, and from 1.0 through versions before 2.2.30, are affected.
How the Vulnerability Works
The flaw stems from a combination of path traversal and symbolic link mis-handling in how Composer registers package binaries. A malicious package can declare a binary that’s actually a symbolic link pointing to a file outside of its package directory. During package installation, Composer might follow that symlink, update the external file’s permissions, and register it as an executable in the project’s vendor/bin directory.
While this issue doesn’t directly grant remote code execution or immediate data access, it can change a file that was restricted (readable only by the owner) into one that’s world-readable and executable. In a shared server or build system, other users or processes could exploit that exposure.
Risk Scenarios & Previous Weaknesses
Composer had earlier introduced protection against packages declaring binaries with literal “..” path segments. However, this protection didn’t cover all scenarios. Researchers found the invalid paths could still be accepted when dealing with symbolic links or when dependency metadata was restored from older environments. That means reused or cached vendor directories—common in CI/CD pipelines and container builds—are particularly risky.
The advisory emphasizes that a standard composer install during deployment or build could silently apply dangerous permission changes using the privileges of whoever runs Composer. Systems that reuse vendor folders from untrusted sources, or bring in dependencies via old containers or cache, are especially vulnerable.
Fixes and Recommended Actions
Updates are available: Composer versions 2.10.3 and 2.2.30 have patched the issue. The fix ensures that any declared binary must resolve to a path inside its own package directory. If a binary attempts to reference an external path, Composer will now skip it and issue a warning rather than altering external files.
Developers and system administrators are advised to immediately upgrade affected Composer instances. They should also clean up any vendor directories coming from untrusted or previous builds, especially those restored from CI caches or shared build environments.
The vulnerability is tied to the following CWE categories: CWE-22 (path traversal), CWE-59 (improper link resolution), and CWE-732 (incorrect permission assignment). Its CVSS rating reports low attack complexity but high potential impact on confidentiality. However, exploitation requires local execution of the dependency install process and some level of user or system interaction.
What this means in broader security terms: Dependency managers remain a high-risk point in modern software supply chains. This flaw underlines how symbolic links and cached artifacts are frequent attack vectors, especially in complex build environments. Teams need stricter validation of build artifacts and tighter control over how dependencies are sourced and installed. Continuous integration and deployment pipelines, shared vendors, and containerized environments are particularly in need of sterilization and verification.
Analytical Insight: This flaw isn’t just about a bug in Composer—it’s a reminder that supply chain defenses must go beyond basic validations. Even protections against “..” path traversal weren’t enough when symbolic links could bypass them. As development workflows increasingly rely on caching, container layers, and artifact reuse, attackers are finding gaps in those processes. The immediate fix helps—but the long-term lesson is that build systems must enforce safety at every step, not just in obvious inputs. Watch for similar patterns in other package managers and second-order dependencies.
