Back Linuxsecurity

Fedora 43 Composer Important Path Traversal Security Fix 2026

Linuxsecurity •LinuxSecurity Advisories • July 11, 2026

Version 2.10.2 - 2026-07-01 Security: Validate package names (GHSA-499r-g7pc-vmp9) Security: Validate package bin paths against path traversal (GHSA-gjfg-22fp- rrxx) Security: Sanitize URL-embedded usernames/token in verbose output (GHSA-g6xq-892h-64w3) Security: Only follow HTTP redirects from HTTP responses (#12948) Security: Prevent phar metadata unserialization on unsafe PHP versions (#12946) Security: Sanitize JSON parse errors in http responses to avoid leaking response body data (#12959) Added warning output in self-update command when using a soon-to-be EOL version (#12920) Added download retry when a GitHub codeload URL returns a 400 (#12962) Fixed audit command to output the audit result to stdout (#12904) Fixed backspace characters being output to non-decorated output (#12925) Fixed security advisory blocking causing issues with xdebug enabled (#12935) Fixed provider packages hiding suggestions for the package they provide themselves (#12933) Fixed secur...

* Wed Jul 1 2026 Remi Collet - 2.10.2-1 - update to 2.10.2

Fedora Update Notification FEDORA-2026-3017b1bec1 2026-07-11 00:52:57.708467+00:00 Name : composer Product : Fedora 43 Version : 2.10.2 Release : 1.fc43 URL : Summary : Dependency Manager for PHP Description : Composer helps you declare, manage and install dependencies of PHP projects, ensuring you have the right stack everywhere. Documentation:

This update can be installed with the "dnf" update program. Use su -c 'dnf upgrade --advisory FEDORA-2026-3017b1bec1' at the command line. For more information, refer to the dnf documentation available at

Get the latest Linux and open source security news straight to your inbox.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Critical Path Traversal Vulnerabilities in Fedora Composer 2026 Fedora has released security updates for Composer affecting versions 2.10.2 in both Fedora 43 and 44. The updates address critical path traversal vulnerabilities that could allow attackers to manipulate package names and bin paths. These vulnerabilities are identified by CVEs GHSA-499r-g7pc-vmp9 and GHSA-gjfg-22fp-rrxx. The updates also include various other security enhancements and bug fixes. Users are advised to upgrade their systems using the 'dnf' update program to mitigate potential risks. The vulnerabilities could impact any PHP project using Composer, emphasizing the need for immediate action by developers and system administrators. The updates were published on July 11, 2026, with the last version update occurring on July 1, 2026. 2 sources 72

Extracted Entities

Fedora 43 Composer Important Path Traversal Security Fix 2026

The full story

Extracted Entities

Companies (1)

CWE Weaknesses (3)

Vulnerabilities (1)