CVE-2026-59948

Name of the Vulnerable Software and Affected Versions Composer versions prior to 2.2.29 Composer versions prior to 2.10.2

Description Composer, a dependency manager for the PHP language, fails to correctly validate package names from untrusted repositories other than Packagist.org or Private Packagist. This allows a maliciously crafted package to cause the application to write attacker-controlled files outside the vendor directory and outside the project during install or update operations.

Recommendations Update to version 2.2.29 or later. Update to version 2.10.2 or later.