Search: CVE-2026-59948

Composer versions prior to 2.2.29 and 2.10.2 are vulnerable to an arbitrary file write issue. A malicious package from an untrusted repository can exploit improper validation of package names to write files outside the vendor directory and project during install or update. This vulnerability is fixed in Composer versions 2.2.29 and 2.10.2.