VulnSocial

CVE-2026-59948Disclosure

LOWCVSS 7.0 · HIGH

Signal is active with 1 mentions in latest observed window

Immediate actions

  • Patch affected systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

Composer is a dependency Manager for the PHP language. Prior to 2.2.29 and 2.10.2, a maliciously crafted package from an untrusted repository other than Packagist.org or Private Packagist can cause Composer to write attacker-controlled files outside the vendor directory and outside the project during install or update by using an invalid package name that is not correctly validated before dependency-resolution results are written or installed. This issue is fixed in versions 2.2.29 and 2.10.2.

Back to dashboard
0.5/ 10 priority

Sources & remediation

Other references
Weakness type (CWE)
CWE-22CWE-787

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

STABLE

Threat summary

  • Patch or workaround signal is available
  • 4 mentions across 2 observed days
  • Momentum state: stable

What's happening

  • Patch or workaround mentioned in 3 signals
  • Technical details provided in 4 signals
  • Disclosure: 2 classified signals
  • Peaked 1d ago at 3 mentions (2026-07-14); latest day: 1
  • 4 total mentions across 2 days

Deep dive

Activity timeline4 mentions / 2d
01223Mentions · 2026-07-14: 3Mentions · 2026-07-15: 1Patch / Workaround · 2026-07-14: 3Technical Details · 2026-07-14: 3Technical Details · 2026-07-15: 107-1407-15
Signal classification2 categories
Disclosure
250.0%
Patch
250.0%
Referenced assets3 URLs
Classification over time
DateTotalLabels
2026-07-143
Disclosure1Patch2
2026-07-151
Disclosure1
Full discourse4 posts
  • yousukezan@yousukezan
    Disclosure

    PHPの依存関係管理ツール「Composer」に3件の脆弱性が見つかり、最も深刻な問題では悪意あるパッケージによってプロジェクト外へ任意のファイルを書き込まれる可能性がある。CVE-2026-59948（CVSS 7.0）を含む問題はComposer 2.10.2および2.2.29で修正され、現時点で悪用は確認されていない。 CVE-2026-59948は依存関係の解決時にパッケージ名の検証が不十分だったため、信頼できないリポジトリの悪意あるパッケージがvendorディレクトリ外へ任意の内容を書き込み、シェル初期化ファイルやSSHのauthorized_keys、cron設定などを配置できる可能性がある。http://Packagist.orgとPrivate Packagistはパッケージ名を検証しているため影響を受けない。CVE-2026-59946（CVSS 6.1）はbinフィールドのパストラバーサルにより、Composerがパッケージ外の既存ファイルへchmodを実行し、秘密鍵などの権限を変更する恐れがある。CVE-2026-59947（CVSS 4.7）はデバッグログへURL内のユーザー名を出力するため、GitHubアクセストークンなどが漏えいする可能性がある。Composerチームはhttp://Packagist.org上で悪用例は確認しておらず、PoCも公開されていないとしている。 https://securityonline.info/php-composer-cve-2026-59948/

    Post summary

    The article reports three newly disclosed CVEs in Composer, details their technical impact and patches, and confirms no active exploitation or PoC has been released.

    0401842.1K
    14.9K followersView on X
  • Daily CyberSecurity@Daily_CyberSec
    Patch

    PHP Composer patched three flaws, including CVE-2026-59948, an arbitrary file write that can run code outside your project. Update to 2.10.2 or 2.2.29. #PHPComposer #Composer #ArbitraryFileWrite #SupplyChain #CVE #PHP #DevSecOps #InfoSec http://securityonline.info/php-composer-cve-2026-59948/

    Post summary

    CVE‑2026‑59948 is an arbitrary file‑write vulnerability in PHP Composer that has been fixed in releases 2.10.2 and 2.2.29; users are advised to update.

    00021413
    12.9K followersView on X
  • ThreatWire@ThreatWire_
    Patch

    🚨 CVE-2026-59948: PHP Composer has patched three vulnerabilities, including an arbitrary file write flaw that could lead to code execution outside a project. Update to v2.10.2 or v2.2.29. #CyberSecurity #CVE #PHP #Composer #ThreatWire

    Post summary

    Composer has patched CVE‑2026‑59948; updating to v2.10.2 or v2.2.29 resolves the arbitrary file write flaw that could allow code execution outside a project.

    0001064
    87 followersView on X
  • キタきつね@foxbook
    Disclosure

    CVE-2026-59948: PHP Composerの脆弱性により、パッケージがプロジェクトコンテキスト外でコードを実行できる CVE-2026-59948: PHP Composer Flaw Lets Packages Execute Code Outside the Project Context #DailyCyberSecurity (Jul 14) https://securityonline.info/php-composer-cve-2026-59948/

    Post summary

    The post announces CVE-2026-59948, a PHP Composer flaw that allows packages to execute code outside the project context. No links to PoC, exploit, active usage, patch, or false positive are provided.

    00000279
    4.9K followersView on X

Explore more

Back to dashboard