DescriptionComposer is a dependency manager for PHP. Users publishing a composer.phar to a public web-accessible server where the composer.phar can be executed as a php file may be subject to a remote code execution vulnerability if PHP also has `register_argc_argv` enabled in php.ini. Versions 2.6.4, 2.2.22 and 1.10.27 patch this vulnerability. Users are advised to upgrade. Users unable to upgrade should make sure `register_argc_argv` is disabled in php.ini, and avoid publishing composer.phar to the web as this is not best practice.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
composer (PTS)buster1.8.4-1+deb10u2vulnerable
buster (security)1.8.4-1+deb10u1vulnerable
bullseye (security)2.0.9-2+deb11u2vulnerable
bookworm (security)2.5.5-1+deb12u1vulnerable
sid, trixie2.7.1-2fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs


[bookworm] - composer <no-dsa> (Minor issue)
[bullseye] - composer <no-dsa> (Minor issue)
[buster] - composer <no-dsa> (Minor issue, only a problem when configured improperly) (1.10.27) (2.2.22) (2.6.4)

Search for package or bug name: Reporting problems