CVE-2026-59944

Composer is a dependency Manager for the PHP language. From 1.0 until 2.2.30 and from 2.3.0 until 2.10.3, a malicious or compromised dependency can bypass the earlier CVE-2026-59946 binary-path hardening because Composer validates literal parent-directory segments only during dependency resolutio...

CVE-2026-59944 Composer: CVE-2026-59946 fix bypass via symlinked package bin path

Composer is a dependency Manager for the PHP language. From 1.0 until 2.2.30 and from 2.3.0 until 2.10.3, a malicious or compromised dependency can bypass the earlier CVE-2026-59946 binary-path hardening because Composer validates literal parent-directory segments only during dependency resolutio...

CVE-2026-59944

Composer is a dependency Manager for the PHP language. From 1.0 until...

EUVD-2026-80863

Composer is a dependency Manager for the PHP language. From 1.0 until 2.2.30 and from 2.3.0 until 2.10.3, a malicious or compromised dependency can bypass the earlier CVE-2026-59946 binary-path hardening because Composer validates literal parent-directory segments only during dependency resolutio...

CVE-2026-59944

CVE-2026-59944 affects Composer (the PHP dependency manager) versions 1.0 through 2.2.30 and 2.3.0 through 2.10.3 . A malicious or compromised dependency can bypass the CVE-2026-59946 binary-path hardening by shipping an in-package binary symlink that resolves outside its installation directory, ...