Composer is a dependency manager for PHP. Users publishing a composer.phar to a public web-accessible server where the composer.phar can be executed as a php file may be subject to a remote code execution vulnerability if PHP also has `register_argc_argv` enabled in php.ini. Versions 2.6.4, 2.2.22 and 1.10.27 patch this vulnerability. Users are advised to upgrade. Users unable to upgrade should make sure `register_argc_argv` is disabled in php.ini, and avoid publishing composer.phar to the web as this is not best practice.
CVSS Details
- CVSS 3.1 Base Score: 6.4
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade composer | Aug 22, 2024 | Sep 29, 2023 |
| Debian | — | Upgrade composerNo solution exists | Mar 28, 2024 | Sep 29, 2023 |
| Freebsd | — | Upgrade php81-composerUpgrade php82-composerUpgrade php83-composer2Upgrade php83-composerUpgrade php82-composer2Upgrade php80-composer2Upgrade php80-composerUpgrade php81-composer2 | Sep 30, 2023 | Sep 29, 2023 |
| Gentoo Linux | — | Upgrade dev-php/composer. | Aug 7, 2025 | Aug 6, 2025 |
| Suse | — | suse-upgrade-php-composer2 | Oct 11, 2023 | Sep 29, 2023 |
| Ubuntu | ubuntu-pro-upgrade-composer | Jun 26, 2025 | Sep 29, 2023 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub