Composer Path Traversal via bin field allowing arbitrary file permission modification (CVE-2025-55946)

Path Traversal Vulnerability: The Field Allows Dependencies to Arbitrary Host Files Vulnerability Overview Composer packages declare their executables in the field of . When Composer installs a package, it processes each entry and changes the file mode of the corresponding file to make it executable. If a entry contains path segments, it can resolve to a path outside the package's own installation directory. A malicious package can exploit this to cause Composer to execute on existing files on the machine, resulting in file modes that are globally readable and executable (0755, under the common umask 022). This occurs during package installation, such as during , , and . Any dependency can trigger this vulnerability, including transitive dependencies, which can be several levels deep. This vulnerability only changes file permissions; it does not read, modify, or execute the content of the target files, nor is it a remote code execution. The impact is limited to confidentiality: files with intentionally restrictive permissions (such as private keys with permissions 0600) can be read by other users on the same host. Scope of Impact Affected Versions: - >= 2.3.0 and = 1.0 and < 2.2.29 Fixed Versions: - 2.10.2 - 2.2.29 Remediation Upgrade to the fixed versions: - 2.2.29 (2.2 LTS branch) - 2.10.2 (Current 2.x branch) Composer 1.x has reached end of life and will not be patched. 1.x users should upgrade to a patched 2.x version. The only complete fix is to upgrade to the patched version. There are no configuration options to disable the vulnerable behavior. Additional Information CVSS v3 Base Metrics: - Attack Vector: Local - Attack Complexity: Low - Privileges Required: None - User Interaction: Required - Scope: Unchanged - Confidentiality: High - Integrity: Low - Availability: None CVE ID: CVE-2025-55946 Weaknesses: - CWE-22 - CWE-732 Credit: Blaaf

Goal Reached Thanks to every supporter — we hit 100%!

Composer Path Traversal via bin field allowing arbitrary file permission modification (CVE-2025-55946)

More from this source