Composer, a PHP dependency manager, has a path traversal vulnerability identified as CVE-2026-59946. The issue arises from the handling of the package bin field, where '..' segments can cause Composer to resolve paths outside the intended package directory. This leads to Composer's binary installation process changing the permissions of arbitrary host files to be world-readable and world-executable. The vulnerability affects versions >=1.0.0 <2.2.29 and >=2.3.0 <2.10.2 and is resolved in versions 2.2.29 and 2.10.2.

An attacker who can supply or influence a package's bin field could cause Composer to modify permissions on arbitrary files on the host system, potentially exposing sensitive files or enabling unauthorized execution. This could lead to privilege escalation or information disclosure depending on the files affected. The vulnerability occurs during normal Composer operations such as install, update, or require.

Upgrade Composer to version 2.2.29 or later, or 2.10.2 or later, where this vulnerability is fixed. No other mitigation is necessary as the issue is resolved in these versions.