{"vulnerability": "ghsa-96h3-5x6v-m776", "sightings": [{"uuid": "20be6c8c-2613-4a8c-ae1b-f8fb227e3536", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "GHSA-96h3-5x6v-m776", "type": "seen", "source": "https://gist.github.com/alon710/2c7a60e8d5c6d36989c99c8115383040", "content": "# CVE-2026-59944: CVE-2026-59944: Path Traversal and Symlink Resolution Bypass in Composer\n\n> **CVSS Score:** 6.1\n> **Published:** 2026-10-02\n> **Full Report:** https://cvereports.com/reports/CVE-2026-59944\n\n## Summary\nCVE-2026-59944 is a path traversal and link-following vulnerability in Composer, the PHP dependency manager. This flaw allows malicious or compromised packages to bypass previous path-hardening protections and perform arbitrary filesystem operations outside of their designated installation directory, leading to unauthorized permission modifications or execution proxy creations.\n\n## TL;DR\nA vulnerability in Composer allows malicious dependencies or manipulated installed.json files to bypass binary path validation. This enables attackers to execute chmod operations or create execution proxies targeting sensitive files outside the package installation directory.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-22, CWE-59\n- **Attack Vector**: Local\n- **CVSS v3.1 Score**: 6.1 (Medium)\n- **EPSS Score / Percentile**: 0.00322 / 22.99%\n- **Impact**: Filesystem Permission Modification, Execution Proxying\n- **Exploit Status**: Proof of Concept\n- **CISA KEV Status**: Not Listed\n\n## Affected Systems\n\n- Composer (PHP dependency manager)\n\n## Mitigation\n\n- Upgrade Composer to patched versions (2.2.30 or 2.10.3)\n- Enforce least-privilege principles for execution context\n- Audit existing deployment scripts and dependency directories for unauthorized symlinks\n\n**Remediation Steps:**\n1. Run 'composer self-update' to obtain the latest security patches.\n2. If running legacy environments, pin to the 2.2 branch via 'composer self-update --2.2'.\n3. Utilize 'find vendor/ -type l -lname \"../*\"' to scan dependencies for external symbolic links.\n\n## References\n\n- [GHSA-96h3-5x6v-m776: Path Traversal/Bypass in Composer Binary Installer](https://github.com/composer/composer/security/advisories/GHSA-96h3-5x6v-m776)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-59944) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-10-02T22:30:28.000000Z"}]}