p4wned

P4WNED CVE-2026-6043 Herramientas de investigación de seguridad de Perforce Helix Core y plantillas de nuclei. Artículo de investigación: https://morganrobertson.net/p4wned/ Lea el artículo para obtener todos los detalles. Solo para objetivos autorizados. Úselo en sus propios servidores o con...

CVE-2026-84361-poc

CVE-2026-84361: Composer Perforce P4PORT Command Execution PoC Run with Docker Docker Compose provides an isolated image containing vulnerable Composer 2.10.2 and the Perforce p4 client. At runtime it has no network, a read-only root filesystem, no Linux capabilities, and writable tmpfs mounts on...

composer-CVE-2026-40261-CVE-2026-40176-PoC

!CAUTION THIS REPOSITORY CONTAINS PROOF-OF-CONCEPT CODE FOR VULNERABILITIES CVE-2026-40261 AND CVE-2026-40176 IN COMPOSER. !CAUTION THE CODE IS INTENDED FOR EDUCATIONAL AND TESTING PURPOSES ONLY. !CAUTION DO NOT USE THIS CODE IN PRODUCTION ENVIRONMENTS OR AGAINST SYSTEMS WITHOUT PROPER...

CVE-2026-40176-poc

CVE-2026-40176: PoC de Inyección de Comandos del Sistema Operativo en Composer Perforce English version Resumen Este repositorio es una Prueba de Concepto PoC para la vulnerabilidad crítica de inyección de comandos del sistema operativo CVE-2026-40176 en el controlador VCS de Perforce de Composer...

CVE-2026-40176

CVE-2026-40176 — Inyección de Comandos en el Controlador Perforce de Composer Prueba de Concepto Una prueba de concepto autocontenida, con estilo OOP en PHP, que demuestra y verifica diferencialmente una vulnerabilidad de inyección de comandos en el controlador de repositorio Perforce de Composer...

cve-2026-40176-cve-2026-40261

CVE-2026-40176 Ejecución Remota de Código RCE en el Repositorio Perforce de Composer 📋 Resumen Vulnerabilidad de Inyección de Comandos en el controlador de repositorio Perforce de Composer que permite la Ejecución Remota de Código RCE mediante una validación insuficiente de entrada en el...

openSUSE 16 Security Update : php-composer2 (openSUSE-SU-2026:21778-1)

The remote openSUSE 16 host has a package installed that is affected by a vulnerability as referenced in the openSUSE- SU-2026:21778-1 advisory. This update for php-composer2 fixes the following issue: - CVE-2026-84361: Arbitrary code execution via malicious Perforce source URL bsc1278257. Tenabl...

GHSA-RVX4-FFVW-M9Q3 Composer arbitrary command execution via a malicious package's Perforce source URL

Summary If the p4 Perforce CLI client is installed, a malicious dependency package from a package repository allowing arbitrary perforce source URLs packagist.org is safe could execute arbitrary commands when running composer install or composer update. Composer passed a package's Perforce source...

EUVD-2026-69608

Composer arbitrary command execution via a malicious package's Perforce source URL...

Composer arbitrary command execution via a malicious package's Perforce source URL

Summary If the p4 Perforce CLI client is installed, a malicious dependency package from a package repository allowing arbitrary perforce source URLs packagist.org is safe could execute arbitrary commands when running composer install or composer update. Composer passed a package's Perforce source...

Security update for php-composer2

This update for php-composer2 fixes the following issue: CVE-2026-84361: Arbitrary code execution via malicious Perforce source URL bsc1278257. Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST onlineupdate or "zypper patch". Alternatively you...

BIT-COMPOSER-2026-84361 Composer: Perforce source URL permits P4PORT `rsh:` command execution

Composer is a dependency Manager for the PHP language. From 1.0 until 2.2.30 and 2.10.3, a malicious dependency package from a custom Composer repository or an untrusted composer.lock file could set source.type to perforce and source.url to an rsh: or jsh: P4PORT value. When the Perforce p4 clien...

PT-2026-86736

Composer is a dependency Manager for the PHP language. From 1.0 until 2.2.30 and 2.10.3, a malicious dependency package from a custom Composer repository or an untrusted composer.lock file could set source.type to perforce and source.url to an rsh: or jsh: P4PORT value. When the Perforce p4 clien...

OPENSUSE-SU-2026:21778-1 Security update for php-composer2

This update for php-composer2 fixes the following issue: - CVE-2026-84361: Arbitrary code execution via malicious Perforce source URL bsc1278257...

Fedora 44 : composer (2026-5995821369)

The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-5995821369 advisory. Version 2.10.3 - 2026-08-27 Security: Validate package bin paths against path traversal using symlinks GHSA-96h3-5x6v-m776, CVE-2026-59944 Security:...

Fedora 43 : composer (2026-0425df0537)

The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-0425df0537 advisory. Version 2.10.3 - 2026-08-27 Security: Validate package bin paths against path traversal using symlinks GHSA-96h3-5x6v-m776, CVE-2026-59944 Security:...

composer: Composer: Arbitrary code execution via malicious Perforce source URL

A flaw was found in Composer. A malicious dependency package from a custom Composer repository or an untrusted composer.lock file could exploit a vulnerability in how Composer handles Perforce source URLs. By setting source.type to perforce and source.url to an rsh: or jsh: P4PORT value, an...

SUSE CVE-2026-84361

Composer is a dependency Manager for the PHP language. From 1.0 until 2.2.30 and 2.10.3, a malicious dependency package from a custom Composer repository or an untrusted composer.lock file could set source.type to perforce and source.url to an rsh: or jsh: P4PORT value. When the Perforce p4 clien...

Linux Distros Unpatched Vulnerability : CVE-2026-84361

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Composer is a dependency Manager for the PHP language. From 1.0 until 2.2.30 and 2.10.3, a malicious dependency package from a custom Composer repository or an...

CVE-2026-84361

A flaw was found in Composer. A malicious dependency package from a custom Composer repository or an untrusted composer.lock file could exploit a vulnerability in how Composer handles Perforce source URLs. By setting source.type to perforce and source.url to an rsh: or jsh: P4PORT value, an...