CyberRota Analysis
AI-GeneratedComposer versions prior to 2.2.29 and 2.10.2 are vulnerable to a path traversal issue that allows a package bin entry with ".." segments to overwrite existing host files, making them world-readable and executable. This vulnerability could lead to unauthorized access to sensitive files on the host system during installation or updates. PHP developers and organizations using Composer for dependency management should prioritize upgrading to the patched versions to mitigate potential security risks.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Composer is a dependency Manager for the PHP language. Prior to 2.2.29 and 2.10.2, a Composer package bin entry containing .. path segments can resolve outside the package install directory and cause Composer's binary installation flow to chmod an existing host file to a world-readable and world-executable mode during composer install, update, or require. This issue is fixed in versions 2.2.29 and 2.10.2.