Composer CVE-2024-36049 Critical Flaw Exposes SSH Keys and Sensitive Files

Key Takeaways

• A critical vulnerability, CVE-2026-59944, has been identified in Composer, the popular PHP dependency manager.
• The flaw allows malicious packages to alter permissions on files outside their installation directory, potentially exposing sensitive data like SSH keys.
• Vulnerable Composer versions range from 2.3.0 up to, but not including, 2.10.3, and from 1.0 up to, but not including, 2.2.30.
• Patches are available in Composer versions 2.10.3 and 2.2.30, and immediate upgrade is strongly recommended.

A significant security vulnerability has been uncovered in Composer, the widely adopted dependency manager for PHP projects. This flaw, designated as CVE-2026-59944, could enable a compromised or malicious package to manipulate file permissions for resources located beyond its intended installation directory.

The issue carries a “Moderate” severity rating but poses a substantial risk on shared or multi-tenant systems. It specifically allows for the exposure of sensitive files if vulnerable Composer versions process package binary paths that are deemed unsafe.

Composer versions affected span from 2.3.0 through those preceding 2.10.3, and also include versions from 1.0 up to, but not including, 2.2.30. Fixes have been released in Composer versions 2.10.3 and 2.2.30. The root cause of this vulnerability lies in weaknesses related to path traversal and the handling of symbolic links during Composer’s management of package binaries.

Understanding the Composer Vulnerability

The core of the vulnerability allows a malicious package to declare a binary file that functions as a symbolic link. This link can then resolve to a target file or directory situated outside the package’s own designated space. When Composer proceeds with the installation, it may inadvertently follow this symbolic link, subsequently modifying the permissions of the external file and registering it as an executable command within the project’s vendor/bin directory.

While this vulnerability does not inherently grant an attacker direct remote code execution or immediate access to victim data, the consequences of altered permissions can be severe. A file previously restricted to its owner could become world-readable and executable. In environments such as shared hosting, multi-user servers, or build platforms, this change could expose confidential information to other local users or processes.

Bypassing Previous Protections

This newly identified flaw effectively circumvents earlier security measures implemented following a previous Composer advisory, GHSA-gjfg-22fp-rrxx. Although prior hardening efforts aimed to reject explicit “..” path segments within declared package binaries, this validation was only applied during a specific stage of dependency resolution.

Security researchers discovered that this validation step could be bypassed when Composer dealt with symbolic links or processed dependency metadata restored from an older environment. The risk escalates significantly when organizations reuse a vendor directory originating from an untrusted or less secure source.

Such scenarios include vendor folders recovered from shared CI caches, copied from earlier container build stages, retained from outdated Composer versions, or modified by a less trusted build process. As the GitHub Advisory states, a standard composer install command executed within a build or deployment pipeline can silently apply these dangerous permission modifications, leveraging the privileges of the account running Composer.

To address this, Composer now rigorously validates that every declared binary resolves strictly within the directory of the package being installed. Should a binary attempt to point outside its package path, Composer will now skip it and issue a warning instead of interacting with the target file.

This vulnerability is categorized under several common weakness enumerations, including CWE-22 (Path Traversal), CWE-59 (Improper Link Resolution), and CWE-732 (Incorrect Permission Assignment for Critical Resources). The CVSS vector for this advisory indicates low attack complexity and high confidentiality impact, though exploitation requires local execution of the dependency installation process and some user interaction.

What You Should Do

• Upgrade Immediately: All administrators and developers should upgrade their Composer installations to version 2.10.3 or 2.2.30 without delay.
• Rebuild Vendor Directories: For critical environments, especially CI/CD pipelines, cached dependencies, container builds, and deployment systems, rebuild vendor directories from known trusted sources.
• Review Permissions: Regularly audit file permissions on sensitive resources, particularly in shared hosting or multi-user server environments.
• Source Trust: Exercise extreme caution when reusing vendor directories or dependency caches from untrusted or less secure origins.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.