CVE-2026-59948 Details

A vulnerability in Composer, a dependency manager for PHP, allows a maliciously crafted package from an untrusted repository (excluding Packagist.org or Private Packagist) to write attacker-controlled files outside the vendor directory and the project itself. This occurs during the installation or update process, using an invalid package name that bypasses proper validation before dependency resolution results are applied. The vulnerability is present in Composer versions prior to 2.2.29 and 2.10.2.

Users can update to Composer versions 2.2.29 or 2.10.2, both of which include the necessary validation to prevent this vulnerability. Instructions for updating Composer can be found in the Composer documentation.