CVE-2026-59946 is a vulnerability in Composer's binary installation process that allows a malicious package to use specially crafted path segments to change existing file permissions on the host system to be world-readable and world-executable. This flaw can lead to sensitive information disclosure and potentially arbitrary code execution. Red Hat's shipped version 2.10.2 of Composer includes the fix for this vulnerability. The issue is tracked under CWE-279 (Incorrect Execution-Assigned Permissions). The Red Hat advisory confirms that the fix is included in their shipped packages and community distributions have been notified.

The vulnerability allows an attacker who can supply a malicious package to alter file permissions on the host system, potentially exposing sensitive information and enabling arbitrary code execution. The impact includes confidentiality breach and integrity compromise with no availability impact. Red Hat rates the severity as medium with a CVSS v3.1 base score of 5.6.

Red Hat ships Composer version 2.10.2 which includes the fix for this vulnerability. Users should ensure they are running this version or later to mitigate the issue. The advisory indicates that the fix is already included in Red Hat Hardened Images RPMs. No additional mitigation steps are required beyond applying the updated packages. Refer to Red Hat's official update channels for applying this update.