GHSA-jm6m-4632-36hfHighCVSS 8.8

Composer Remote Code Execution vulnerability via web-accessible composer.phar

Published
September 29, 2023
Last Modified
February 13, 2025

🔗 CVE IDs covered (1)

CVE-2023-43655 →

📋 Description

Impact

Users publishing a composer.phar to a public web-accessible server where the composer.phar can be executed as a php file may be impacted if PHP also has register_argc_argv enabled in php.ini.

Patches

2.6.4, 2.2.22 and 1.10.27 patch this vulnerability.

Workarounds

Make sure register_argc_argv is disabled in php.ini, and avoid publishing composer.phar to the web as this really should not happen.

🎯 Affected products3

  • composer/composer/composer:< 1.10.27
  • composer/composer/composer:>= 2.0.0, < 2.2.22
  • composer/composer/composer:>= 2.3.0, < 2.6.4

🔗 References (10)