Summary A maliciously crafted package, published on an untrusted third party repository other than Packagist.org or Private Packagist, can cause Composer to write files outside the vendor/ directory and outside your pro…
| CVE ID | CVE-2026-59948 |
| Vendor | composer |
| Affected Product | composer/composer |
| Vulnerability Type | Vulnerability |
| CVSS Score | 7.0 (HIGH) |
| EPSS Score | 0.1% probability of exploitation in the next 30 days |
| Actively Exploited | ❌ No known exploitation |
| Patch Status | See Vendor Advisory → |
| Reported By | CYBERDUDEBIVASH SENTINEL APEX Intelligence (via github_advisories) |
#
vendor/ directory and outside your project, with attacker-controlled content, during a normal install or update through using an invalid package name, which was not correctly validated by Composer. This is an arbitrary file write that can be used to execute code outside the Composer project's context in which you expected the package code to execute (for example by writing shell startup files, SSH authorized_keys, or a cron entry). It is a supply-chain issue: it requires a malicious or compromised package to be present in the dependency graph, it is not otherwise remotely exploitable against a machineSigma rules, YARA signatures, IOC table, and SIEM queries for Splunk, Elastic, Sentinel, and Chronicle — deployable in 5 minutes.