CVE-2026-59946

Name of the Vulnerable Software and Affected Versions Composer versions prior to 2.2.29 Composer versions prior to 2.10.2

Description A flaw in the binary installation flow allows a package bin entry containing .. path segments to resolve outside the package installation directory. This can lead to the system changing the permissions of an existing host file to world-readable and world-executable modes during the execution of composer install, update, or require operations.

Recommendations Update to version 2.2.29 or later. Update to version 2.10.2 or later.