Critical Path Traversal Vulnerabilities in Fedora Composer 2026

Fedora has released security updates for Composer affecting versions 2.10.2 in both Fedora 43 and 44. The updates address critical path traversal vulnerabilities that could allow attackers to manipulate package names and bin paths. These vulnerabilities are identified by CVEs GHSA-499r-g7pc-vmp9 and GHSA-gjfg-22fp-rrxx. The updates also include various other security enhancements and bug fixes. Users are advised to upgrade their systems using the 'dnf' update program to mitigate potential risks. The vulnerabilities could impact any PHP project using Composer, emphasizing the need for immediate action by developers and system administrators. The updates were published on July 11, 2026, with the last version update occurring on July 1, 2026.

Key Points: • Critical path traversal vulnerabilities found in Composer for Fedora 43 and 44. • Users should upgrade to Composer version 2.10.2 to mitigate risks. • The vulnerabilities could allow unauthorized access to PHP project dependencies.