Composer: GHSA-gjfg-22fp-rrxx fix bypass via symlinked package bin path
Medium · CVSS 6.1
## Summary A malicious or compromised Composer package could, when installed as a dependency, cause Composer to change the permissions of a file outside that package's own directory and to register a runnable `vendor/bin` command that points at that outside file. This is a path traversal and link following issue. It is not remote code execution, the attacker gains no ability to read or receive your data directly.
Remediation
Upgrade composer/composer to 2.10.3 or later. Upgrade composer/composer to 2.2.30 or later.
Affected PHP branches
See the source advisory.
Source: GitHub Global Security Advisories (Composer ecosystem) · retrieved 2026-10-22T10:19:14-04:00 · https://github.com/advisories/GHSA-96h3-5x6v-m776