Composer versions before 2.2.29 and 2.10.2 allow a maliciously crafted package from untrusted repositories (other than Packagist.org or Private Packagist) to write attacker-controlled files outside the vendor directory and project root during install or update. This is caused by insufficient validation of invalid package names before dependency resolution results are written or installed. The vulnerability is addressed in Composer versions 2.2.29 and 2.10.2.

An attacker controlling a package in an untrusted repository can cause Composer to write files outside the expected directories, potentially leading to arbitrary file write and compromise of the project environment. This could result in full confidentiality, integrity, and availability impact on the affected system as indicated by the CVSS vector.

Upgrade Composer to version 2.2.29 or later, or 2.10.2 or later, where this vulnerability is fixed. No other mitigations are specified. Patch status is confirmed fixed in these versions.