Composer CVE-2026-59946

The victim must run composer install, composer update, or composer require while installing or updating a package that contains a bin entry with .. path traversal segments in its composer.json. No special Composer configuration is required - default Composer usage is sufficient. The attacker must control or compromise a Composer package that the victim installs; this is the primary limiting factor, as it requires either publishing a new malicious package the victim adds as a dependency, or compromising an existing package in the victim's dependency tree. The effective scope of the chmod is bounded by the OS permissions of the user running Composer: if run as a non-root user, only files owned by or world-accessible to that user can be affected; if run as root (common in some CI/CD pipelines), any file on the system is a potential target. Versions 2.2.29 and 2.10.2 and later are not affected.

The provided CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N, score 6.1) accurately captures the threat model: local execution, low complexity, user interaction required (running Composer), high confidentiality impact. The PR:N metric reflects that the attacker is a malicious package author who needs no privileges on the victim's system - only the ability to publish or compromise a Composer package the victim installs. The real-world risk is concentrated in two scenarios: developer workstations (where sensitive files like SSH keys, .env files, or config files could be made world-readable) and CI/CD pipelines running as privileged users, where the impact of a permissive chmod is far broader. No EPSS data is provided, no CISA KEV listing exists, and no public POC is identified at time of analysis, suggesting exploitation has not been observed at scale. However, the attack is straightforward conceptually - a motivated threat actor with a published package can exploit this deterministically whenever a victim installs. The absence of KEV should not be interpreted as low-priority for teams consuming third-party Composer packages in automated pipelines.

A threat actor publishes a Composer package (or compromises an existing popular package) and includes a bin entry such as ../../../../../../home/ci/.ssh/id_rsa in its composer.json. When a developer or CI/CD pipeline runs composer require malicious/package or composer update, Composer resolves the traversal path and executes chmod on the SSH private key, making it world-readable to all users on the system. No public exploit code has been identified at time of analysis, but the attack is mechanistically straightforward given the description.