Composer Flaw Lets Malicious Dependencies Expose SSH Keys and Sensitive Files

A newly disclosed security flaw in Composer, the widely used dependency manager for PHP, could allow a malicious or compromised package to alter permissions on files located outside its own installation directory.

The issue, tracked as CVE-2026-59944, can expose sensitive files on shared or multi-tenant systems when vulnerable Composer versions process unsafe package binary paths.

The advisory is rated Moderate and affects Composer versions from 2.3.0 through versions before 2.10.3, as well as versions from 1.0 through versions before 2.2.30.

Composer has released fixes in versions 2.10.3 and 2.2.30. The vulnerability stems from a path traversal and symbolic-link handling weakness in the way Composer manages package binaries.

Composer Vulnerability Exposure

A malicious package can declare a binary file that is a symbolic link resolving to a target outside the package’s directory.

During installation, Composer may follow that link, change the permissions of the external file, and register it as a runnable command under the project’s vendor/bin directory.

An attacker does not gain direct remote code execution or immediate access to a victim’s data through this flaw alone. However, the permission change can make a file that was previously readable only by its owner become world-readable and executable.

On a shared hosting environment, multi-user server, or build platform, other local users or processes may then be able to access the exposed content.

The issue bypasses protections introduced in a previous Composer advisory, GHSA-gjfg-22fp-rrxx. Earlier hardening rejected literal “..” path segments in declared package binaries, but the validation was applied only in one stage of dependency resolution.

Security researchers found that the validation could be skipped when Composer handled symbolic links or dependency metadata restored from an earlier environment. Risk is highest when organizations reuse a vendor directory from an untrusted or lower-trust source.

Examples include vendor folders restored through shared CI caches, copied from an earlier container build stage, retained from older Composer versions, or modified by a less trusted build process.

The GitHub Advisory states that a normal composer install command in a build or deployment pipeline can silently apply the dangerous permission modification using the privileges of the account running Composer.

Composer now validates that every declared binary resolves within the directory of the package being installed. If a binary points outside the package path, Composer skips it and displays a warning rather than touching the target file.

Administrators and developers should upgrade immediately to Composer 2.10.3 or 2.2.30. Rebuilding vendor directories from trusted sources is also important, particularly for CI/CD pipelines, cached dependencies, container builds, and deployment systems.

The flaw is associated with CWE-22 path traversal, CWE-59 improper link resolution, and CWE-732 incorrect permission assignment for critical resources.

The advisory’s CVSS vector indicates low attack complexity and high confidentiality impact; however, exploitation requires local execution of the dependency installation process and user interaction.

Prevent incidents due to slow investigations. Power your Tier 1 with threat intelligence from 15K SOCs: Integrate TI Lookup in your SOC