openSUSE 16 Security Update : php-composer2 (openSUSE-SU-2026:21520-1)

The remote openSUSE 16 host has a package installed that is affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21520-1 advisory. - CVE-2026-45793: Github Actions issued GITHUBTOKEN disclosure in GitHub Actions logs bsc1271504. - CVE-2026-59946: path traversal in package bi...

SUSE-SU-2026:23138-1 Security update for php-composer2

This update for php-composer2 fixes the following issues: - CVE-2026-45793: Github Actions issued GITHUBTOKEN disclosure in GitHub Actions logs bsc1271504. - CVE-2026-59946: path traversal in package bin field lets dependencies chmod arbitrary host files bsc1271151. - CVE-2026-59947: URL-embedded...

Security update for php-composer2

This update for php-composer2 fixes the following issues: CVE-2026-45793: Github Actions issued GITHUBTOKEN disclosure in GitHub Actions logs bsc1271504. CVE-2026-59946: path traversal in package bin field lets dependencies chmod arbitrary host files bsc1271151. CVE-2026-59947: URL-embedded...

CVE-2026-59946

Composer is a dependency Manager for the PHP language. Prior to 2.2.29 and 2.10.2, a Composer package bin entry containing .. path segments can resolve outside the package install directory and cause Composer's binary installation flow to chmod an existing host file to a world-readable and...