Back Linuxsecurity

Fedora 43 Composer Vulnerability in Path Traversal and Command Injection

Linuxsecurity •LinuxSecurity Advisories • September 5, 2026

Share: View original

Keep your Linux systems secure and up to date with practical patching guidance. Review Linux Patching Best Practices ×

Composer helps you declare, manage and install dependencies of PHP projects,

ensuring you have the right stack everywhere.

Documentation:

Version 2.10.3 - 2026-08-27 Security: Validate package bin paths against path traversal using symlinks (GHSA-96h3-5x6v-m776, CVE-2026-59944) Security: Fixed command injection via malicious Perforce url (GHSA- rvx4-ffvw-m9q3) Security: Sanitize URL-embedded usernames/token in a few more places (#13044) Security: Fixed matching of gitlab URLs to avoid possible credential leak to the wrong domain (#12988) Fixed PHP 8.6 deprecation warnings (#12967, #13028) Fixed error output when a policy blocks a package version to be clearer (#12993) Fixed the lock file's content-hash with a conflict marker ending up breaking at runtime (#13048) Fixed possible race condition while creating directories like the cache dir when running multiple Composer processes in parallel (#12977) Fixed forgejo support to handle empty repositories better (#12968) Fixed FilterListApiClient not forwarding transport options (#13040)

* Thu Aug 27 2026 Remi Collet - 2.10.3-1 - update to 2.10.3

[ 1 ] Bug #2527243 - CVE-2026-84361 composer: Composer: Arbitrary code execution via malicious Perforce source URL [fedora-all]

This update can be installed with the "dnf" update program. Use su -c 'dnf upgrade --advisory FEDORA-2026-0425df0537' at the command line. For more information, refer to the dnf documentation available at

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.

Linux Security - Your source for Top Linux News, Advisories, HOWTOs and Feature Releases

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Fedora Composer Vulnerabilities Lead to Security Risks Fedora 44 Composer has released an update addressing multiple security vulnerabilities, including a path traversal issue (CVE-2026-59944) and command injection via malicious Perforce URLs (CVE-2026-84361). These vulnerabilities could allow attackers to execute arbitrary code or access sensitive data. The Composer tool, essential for managing PHP project dependencies, is affected in versions prior to 2.10.3. Users are advised to update their systems to mitigate these risks. The vulnerabilities were disclosed on September 1, 2026, and the update was made available on August 27, 2026. Administrators are encouraged to apply the patch using the 'dnf' update program to secure their systems. The security flaws highlight the importance of maintaining updated software to prevent exploitation. 2 sources 61

Extracted Entities

Fedora 43 Composer Vulnerability in Path Traversal and Command Injection

The full story

Extracted Entities

Attack Types (1)

CVEs (2)

CWE Weaknesses (2)

MITRE ATT&CK (1)

Platforms (1)