CVE-2026-59944: Composer 2.10.3 Patches Symlink Path Traversal and Perforce Command Injection — Defend Your PHP Supply Chain

On August 27, 2026, the Composer project released version 2.10.3, and Fedora has now pushed that build to Fedora 44 users as update 2026-5995821369. This is not a routine maintenance release — it closes two distinct security weaknesses in the most widely deployed PHP dependency manager on the planet:

1. CVE-2026-59944 (GHSA-96h3-5x6v-m776) — Composer failed to validate package bin paths against path traversal using symlinks, allowing a malicious package to write or link executables outside the intended vendor/bin sandbox.
2. GHSA-rvx4-ffvw-m9q3 — Command injection via a maliciously crafted Perforce (p4) repository URL, letting an attacker who controls or poisons a package's VCS reference execute arbitrary commands wherever composer install or composer update runs.

If you run PHP anywhere in your build pipeline — and statistically, you do — Composer executes on developer laptops, CI/CD runners, container builds, and deployment targets, frequently with credentials for private repositories, artifact registries, and cloud providers in scope. Both flaws are classic supply-chain primitives: they don't require compromising your code, only convincing your tooling to trust a malicious package or repository definition. Treat this as a priority patch, not a backlog item.

Technical Analysis

Affected Products and Versions

• Product: Composer (PHP dependency manager), all supported 2.x lines prior to 2.10.3
• Fixed version: Composer 2.10.3 (released 2026-08-27)
• Distribution: Fedora 44 via update 2026-5995821369; the fix applies equally to Composer installed via composer self-update, PHAR distribution, or other distro packages (Debian/Ubuntu, RHEL/EPEL, Homebrew) running any 2.x build below 2.10.3
• Exposure surface: Any environment where Composer resolves third-party packages — developer workstations, Jenkins/GitHub Actions/GitLab CI runners, Docker builds, deployment automation

Vulnerability 1 — CVE-2026-59944: Bin Path Traversal via Symlinks

Composer packages can declare binaries in their composer.json bin field. During installation, Composer proxies or symlinks those binaries into the project's vendor/bin/ directory so they land on the consumer's PATH. The flaw: Composer validated the declared bin path lexically but did not resolve symlinks before validation. A malicious package could ship a symlink inside its own tree (e.g., bin/tool -> ../../../../.config/composer or an absolute path) and declare it as a binary. When Composer installs the package, the link target resolves outside the vendor directory, giving the attacker the ability to:

• Plant an executable shim at an attacker-chosen location on the filesystem
• Overwrite or shadow a trusted binary that later executes in a build, cron, or login context
• Persist code execution on developer machines and CI runners that will survive composer update cycles

Exploitation requires the victim to install a malicious or compromised package — exactly the trust relationship that dependency-confusion, typosquatting, and maintainer-account-takeover campaigns already abuse. No user interaction beyond a normal composer install/update is needed.

Vulnerability 2 — GHSA-rvx4-ffvw-m9q3: Perforce URL Command Injection

Composer supports pulling packages from alternative VCS drivers, including Perforce. The Perforce driver constructed shell commands using values derived from the repository URL without adequate sanitization. A composer.json or composer.lock referencing a crafted p4:// (or Perforce depot) URL could inject shell metacharacters that Composer then executed when it invoked the Perforce client to fetch the dependency.

The realistic attack chain: an attacker who can influence a dependency's repository definition — via a compromised upstream package, a poisoned internal package index, or a malicious pull request adding a repositories entry — achieves arbitrary command execution in the context of whatever user or service account runs Composer. On a CI runner, that frequently means access to signing keys, deployment tokens, and cloud IAM instance credentials.

Exploitation Status

As of this writing there is no confirmed in-the-wild exploitation and no public weaponized PoC for either issue, and neither appears in CISA's Known Exploited Vulnerabilities catalog. Both were disclosed through coordinated GitHub Security Advisories alongside the fix. That said, Composer vulnerabilities historically attract rapid reverse-engineering: the patch diff publicly documents the exact validation gap, and dependency-manager RCE is a top-tier target for supply-chain operators. The window between "patch available" and "PoC circulating" for this class of bug is typically measured in days. Don't wait for a KEV entry to act.

Detection & Response

These detections target the two observable behaviors: Composer spawning unexpected child processes (the Perforce injection path) and binaries/symlinks escaping vendor/bin (the path traversal path). Tune the allowlists to your legitimate build tooling before broad deployment.

---
title: Composer Spawning Suspicious Child Process
description: Detects Composer (PHP dependency manager) spawning shells, network tools, or script interpreters as child processes — consistent with command injection via a malicious VCS URL such as the Perforce driver flaw (GHSA-rvx4-ffvw-m9q3) or a malicious package bin shim.
logsource:
  category: process_creation
  product: linux
detection:
  selection_parent:
    ParentCommandLine|contains:
      - 'composer'
      - 'composer.phar'
  selection_child:
    CommandLine|contains:
      - '/bin/sh'
      - '/bin/bash'
      - 'curl '
      - 'wget '
      - 'nc '
      - 'ncat '
      - 'base64 -d'
      - 'python'
      - 'perl '
  filter_composer_scripts:
    CommandLine|startswith:
      - '/usr/bin/php'
  condition: selection_parent and selection_child and not filter_composer_scripts
falsepositives:
  - Composer install/update scripts legitimately invoking shell commands defined in composer.json scripts hooks
level: high
---
title: Composer Invoked with Perforce Repository Reference
description: Detects Composer operations referencing Perforce (p4) depots, an uncommon VCS driver in most PHP environments and the injection vector patched in Composer 2.10.3 (GHSA-rvx4-ffvw-m9q3).
logsource:
  category: process_creation
  product: linux
detection:
  selection:
    CommandLine|contains:
      - 'composer'
  selection_p4:
    CommandLine|contains:
      - 'p4://'
      - 'p4 -p'
      - 'perforce'
  condition: selection and selection_p4
falsepositives:
  - Organizations with legitimate Perforce-hosted PHP dependencies (rare — validate against internal package inventory)
level: medium
---
title: Symlink or Executable Planted Outside vendor/bin During Dependency Install
description: Detects file creation of executables or symlinks in sensitive user and system locations while a Composer or PHP process is active — indicative of bin path traversal via symlinks (CVE-2026-59944) escaping the vendor directory.
logsource:
  category: file_event
  product: linux
detection:
  selection_paths:
    TargetFilename|contains:
      - '/.bashrc'
      - '/.profile'
      - '/.bash_profile'
      - '/.config/autostart/'
      - '/.ssh/authorized_keys'
      - '/etc/cron'
      - '/usr/local/bin/'
      - '/etc/systemd/system/'
  selection_actor:
    Image|contains:
      - 'php'
      - 'composer'
  condition: selection_paths and selection_actor
falsepositives:
  - PHP-based installers or provisioning tools with legitimate reasons to write these paths — investigate per-host
level: high

// Hunt: Composer spawning shells or network tools, and Perforce references in build activity
// Works against Syslog/CEF-ingested Linux auditd or EDR process telemetry in Sentinel
let lookback = 14d;
union isfuzzy=true
  (DeviceProcessEvents
    | where TimeGenerated > ago(lookback)
    | where ProcessCommandLine has_any ("composer", "composer.phar")
       or InitiatingProcessCommandLine has_any ("composer", "composer.phar")
    | where ProcessCommandLine has_any ("p4://", "perforce", "/bin/sh -c", "curl ", "wget ", "base64 -d")
    | project TimeGenerated, DeviceName, AccountName, InitiatingProcessCommandLine, ProcessCommandLine, FileName, FolderPath),
  (Syslog
    | where TimeGenerated > ago(lookback)
    | where SyslogMessage has "composer"
    | where SyslogMessage has_any ("p4://", "perforce", "/bin/sh", "curl ", "wget ")
    | project TimeGenerated, Computer, HostIP, ProcessName, SyslogMessage)
| sort by TimeGenerated desc

-- Hunt: Composer/PHP child processes and suspicious Perforce usage across the fleet
-- Plus: enumerate vendor/bin symlinks resolving outside their vendor directory
LET procs = SELECT Pid, Ppid, Name, CommandLine, Exe, Username, CreateTime
  FROM pslist()
  WHERE CommandLine =~ '(?i)composer'
     OR Name =~ '(?i)composer|p4'

SELECT * FROM procs

-- Enumerate symlinks under vendor/bin directories and flag non-relative escapes
SELECT FullPath AS BinPath,
       readlink(FullPath) AS LinkTarget,
       ModTime
FROM glob(globs='/**/vendor/bin/*')
WHERE LinkTarget AND (LinkTarget =~ '^/' OR LinkTarget =~ '\\.\\./\\.\\./\\.\\.')

#!/usr/bin/env bash
# Composer 2.10.3 security verification & remediation — CVE-2026-59944 / GHSA-rvx4-ffvw-m9q3
set -euo pipefail

VULN_FOUND=0

# 1. Locate every Composer installation and check version
echo "[*] Checking Composer versions..."
for bin in $(command -v composer || true) /usr/local/bin/composer /usr/bin/composer "$HOME/.composer/vendor/bin/composer"; do
  [ -x "$bin" ] || continue
  ver=$("$bin" --version --no-ansi 2>/dev/null | grep -oE '[0-9]+\.[0-9]+\.[0-9]+' | head -1)
  echo "    $bin -> $ver"
  if [ -n "$ver" ]; then
    if [ "$(printf '%s\n' "2.10.3" "$ver" | sort -V | head -1)" != "2.10.3" ]; then
      echo "[!] VULNERABLE: $bin ($ver) < 2.10.3"
      VULN_FOUND=1
    fi
  fi
done

# 2. Remediate: prefer distro package on Fedora, else self-update
echo "[*] Remediating..."
if command -v dnf >/dev/null 2>&1 && rpm -q composer >/dev/null 2>&1; then
  sudo dnf upgrade --refresh -y composer   # Fedora 44 update 2026-5995821369
elif command -v composer >/dev/null 2>&1; then
  composer self-update 2.10.3
fi

# 3. Audit vendor/bin for symlink escapes (CVE-2026-59944 artifact)
echo "[*] Auditing vendor/bin symlinks for path traversal..."
find / -type d -name bin -path '*/vendor/bin' 2>/dev/null | while read -r d; do
  find "$d" -type l 2>/dev/null | while read -r l; do
    target=$(readlink -f "$l")
    case "$target" in
      "$(dirname "$d")"/*) : ;;  # resolves inside vendor tree — expected
      *) echo "[!] SUSPICIOUS SYMLINK: $l -> $target" ;;
    esac
  done
done

# 4. Flag Perforce repository references in dependency manifests
echo "[*] Scanning composer.json/composer.lock for Perforce VCS references..."
grep -rlE '"type"\s*:\s*"(perforce|p4)"|p4://' \
  --include='composer.json' --include='composer.lock' \
  /var/www /srv /home 2>/dev/null | while read -r f; do
  echo "[!] Perforce reference found in: $f — verify this is intentional"
done

# 5. Check for post-install persistence from a malicious bin shim
echo "[*] Checking shell profiles and cron for recent unexpected modification..."
find /home -maxdepth 2 \( -name '.bashrc' -o -name '.profile' -o -name '.bash_profile' \) -mtime -14 2>/dev/null
ls -lt /etc/cron.d/ 2>/dev/null | head -5

[ "$VULN_FOUND" -eq 0 ] && echo "[+] No vulnerable Composer binaries detected post-remediation."

Remediation

1. Patch everywhere Composer executes — not just servers. Upgrade to Composer 2.10.3 immediately:
   • Fedora 44: sudo dnf upgrade composer (update 2026-5995821369)
   • PHAR installs: composer self-update 2.10.3
   • CI/CD images: rebuild base images and runner templates — pinned Composer versions in Dockerfiles are the most commonly forgotten exposure.
2. Audit for pre-patch compromise. Because both flaws write or execute outside the dependency tree, run the symlink audit and Perforce-reference scan above across developer machines and runners. Investigate any vendor/bin symlink resolving outside its vendor directory and any shell profile, cron, or autostart modification correlating with a dependency install window.
3. Constrain what Composer can reach:
   • Remove or restrict Perforce (p4) VCS usage unless your organization genuinely uses Perforce-hosted PHP packages — for the vast majority of teams, this driver is pure attack surface.
   • Pin composer.lock in CI and use composer install --no-scripts for untrusted or third-party code review contexts (note: this does not mitigate the bin-path flaw — patching does).
   • Run builds as a dedicated low-privilege account with no cloud instance-role credentials where feasible; use short-lived OIDC federation instead of static tokens on runners.
4. Harden the supply chain gate: enforce private package repository proxying (e.g., an internal Packagist/Satis mirror or artifact repository), block direct outbound VCS fetches from CI where possible, and alert on new repositories entries in pull requests.
5. Reference advisories:
   • Fedora update: https://linuxsecurity.com/advisories/fedora/fedora-44-composer-2026-5995821369
   • GHSA-96h3-5x6v-m776 (CVE-2026-59944) and GHSA-rvx4-ffvw-m9q3 via the GitHub Advisory Database

Neither flaw has a configuration workaround that fully closes the hole — the only complete fix is 2.10.3. Given that Composer sits upstream of your production PHP applications, treat this with the same urgency as a framework-level RCE.

Related Resources

Security Arsenal Penetration Testing Services AlertMonitor Platform Book a SOC Assessment vulnerability-management Intel Hub