CyberRota Analysis
AI-GeneratedComposer versions prior to 2.2.29 and 2.10.2 are vulnerable to arbitrary file write attacks due to insufficient validation of package names from untrusted repositories. This flaw allows attackers to manipulate the installation process, potentially leading to the execution of malicious code or data exfiltration. Developers and organizations using affected versions should prioritize upgrading to the patched versions to mitigate this high-severity risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Composer is a dependency Manager for the PHP language. Prior to 2.2.29 and 2.10.2, a maliciously crafted package from an untrusted repository other than Packagist.org or Private Packagist can cause Composer to write attacker-controlled files outside the vendor directory and outside the project during install or update by using an invalid package name that is not correctly validated before dependency-resolution results are written or installed. This issue is fixed in versions 2.2.29 and 2.10.2.