Skip to main content

Composer CVE-2026-11914

| EUVDEUVD-2026-43092 MEDIUM
Improper Input Validation (CWE-20)
2026-07-10 drupal GHSA-qfp7-j94c-gx97
Information Disclosure Composer
5.9
CVSS 3.1 · Vendor: drupal
Share

Severity by source

Vendor (drupal) PRIMARY
5.9 MEDIUM
AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:N

Primary rating from Vendor (drupal) · only source for this CVE.

CVSS VectorVendor: drupal

CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:N
Attack Vector
Network
Attack Complexity
High
Privileges Required
High
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
None

Lifecycle Timeline

1
CVE Published
Jul 10, 2026 - 21:59 cve.org
UNKNOWN (no severity yet)

DescriptionCVE.org

vulnerability in Drupal Composer allows . This issue affects Composer versions: *.*.

Analysis

vulnerability in Drupal Composer allows . This issue affects Composer versions: *.*.

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Composer

View all
CVE-2021-29472 HIGH POC
8.8 Apr 27

Composer is a dependency manager for PHP. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, lo
CVE-2023-1596 MEDIUM POC
6.1 May 15

The tagDiv Composer WordPress plugin before 4.0 does not sanitise and escape a parameter before outputting it back in th
CVE-2021-41116 CRITICAL
9.8 Oct 05

Composer is an open source dependency manager for the PHP language. Rated critical severity (CVSS 9.8), this vulnerabili
CVE-2023-43655 HIGH
8.8 Sep 29

Composer is a dependency manager for PHP. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, lo
CVE-2022-24828 HIGH
8.8 Apr 13

Composer is a dependency manager for the PHP programming language. Rated high severity (CVSS 8.8), this vulnerability is
CVE-2026-10043 HIGH
7.8 Jun 24

Arbitrary code execution in MosaicML Composer arises when the library loads a model or resumption checkpoint, because ch
CVE-2026-59948 HIGH
7.0 Jul 08

Arbitrary file write in Composer (the PHP dependency manager) before 2.2.29 and 2.10.2 allows a malicious package served
CVE-2025-3510 MEDIUM
6.4 May 02

The tagDiv Composer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple shortcodes in all ver
CVE-2026-59946 MEDIUM
6.1 Jul 08

Path traversal in Composer's binary installation flow allows a malicious PHP package to cause arbitrary host files to be
CVE-2026-59947 MEDIUM
4.7 Jul 08

Credential leakage in Composer PHP dependency manager exposes sensitive tokens - such as GitHub Personal Access Tokens e

Same weakness CWE-20 – Improper Input Validation

View all
CVE-2021-44228 CRITICAL POC
10.0
CVE-2024-3400 CRITICAL POC
10.0
CVE-2022-47966 CRITICAL POC
9.8
CVE-2023-22515 CRITICAL POC
9.8
CVE-2009-0927 HIGH POC
8.8
CVE-2017-9791 CRITICAL POC
9.8
CVE-2017-15944 CRITICAL POC
9.8
CVE-2019-0604 CRITICAL POC
9.8

Same technique Information Disclosure

View all
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8
CVE-2023-7028 CRITICAL POC
10.0
CVE-2017-0213 HIGH POC
7.3

Share

CVE-2026-11914 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy