BIT-composer-2026-59948: Composer: Arbitrary file write outside vendor via malicious transitive package name
Composer versions prior to 2.2.29 and 2.10.2 are vulnerable to an arbitrary file write issue. A malicious package from an untrusted repository can exploit improper validation of package names to write files outside the vendor directory and project during install or update. This vulnerability is fixed in Composer versions 2.2.29 and 2.10.2.
AI Analysis
Technical Summary
Composer, a PHP dependency manager, has a vulnerability (CVE-2026-59948) where maliciously crafted packages from untrusted repositories (other than Packagist.org or Private Packagist) can cause arbitrary file writes outside the vendor directory and project root. This occurs because invalid package names are not properly validated before dependency resolution results are written or installed. The issue affects versions prior to 2.2.29 and 2.10.2 and is resolved in those fixed versions.
Potential Impact
An attacker controlling a malicious package in an untrusted repository can write arbitrary files outside the intended vendor directory and project scope during Composer install or update operations. This can lead to unauthorized file creation or modification, potentially enabling code execution or other malicious activities depending on the files written.
Mitigation Recommendations
Upgrade Composer to version 2.2.29 or later, or 2.10.2 or later, where this vulnerability is fixed. No other mitigations are specified. Patch status is confirmed by the vendor advisory indicating these fixed versions.
BIT-composer-2026-59948: Composer: Arbitrary file write outside vendor via malicious transitive package name
Description
Composer versions prior to 2.2.29 and 2.10.2 are vulnerable to an arbitrary file write issue. A malicious package from an untrusted repository can exploit improper validation of package names to write files outside the vendor directory and project during install or update. This vulnerability is fixed in Composer versions 2.2.29 and 2.10.2.
Affected software
pkg:bitnami/composerRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
Composer, a PHP dependency manager, has a vulnerability (CVE-2026-59948) where maliciously crafted packages from untrusted repositories (other than Packagist.org or Private Packagist) can cause arbitrary file writes outside the vendor directory and project root. This occurs because invalid package names are not properly validated before dependency resolution results are written or installed. The issue affects versions prior to 2.2.29 and 2.10.2 and is resolved in those fixed versions.
Potential Impact
An attacker controlling a malicious package in an untrusted repository can write arbitrary files outside the intended vendor directory and project scope during Composer install or update operations. This can lead to unauthorized file creation or modification, potentially enabling code execution or other malicious activities depending on the files written.
Mitigation Recommendations
Upgrade Composer to version 2.2.29 or later, or 2.10.2 or later, where this vulnerability is fixed. No other mitigations are specified. Patch status is confirmed by the vendor advisory indicating these fixed versions.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- BIT-composer-2026-59948
- Osv Schema Version
- 1.6.2
- Aliases
- ["CVE-2026-59948"]
- Ecosystems
- ["Bitnami"]
- Database Specific Severity
- High
- Cvss Version
- null
Threat ID: 6a561c4a68715ace4365a2fc
Added to database: 07/14/2026, 11:23:54 UTC
Last enriched: 07/14/2026, 11:32:26 UTC
Last updated: 07/14/2026, 11:32:26 UTC
Views: 3
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.