CVE-2022-24828

Composer is a dependency manager for the PHP programming language. Integrators using Composer code to call VcsDriver::getFileContent can have a code injection vulnerability if the user can control the $file or $identifier argument. This leads to a vulnerability on packagist.org for example where the composer.json's readme field can be used as a vector for injecting parameters into hg/Mercurial via the $file argument, or git via the $identifier argument if you allow arbitrary data there (Packagist does not, but maybe other integrators do). Composer itself should not be affected by the vulnerability as it does not call getFileContent with arbitrary data into $file/$identifier. To the best of our knowledge this was not abused, and the vulnerability has been patched on packagist.org and Private Packagist within a day of the vulnerability report.

The Composer method VcsDriver::getFileContent() with user-controlled $file or $identifier arguments is susceptible to an argument injection vulnerability. It can be leveraged to gain arbitrary command execution if the Mercurial or the Git driver are used.

This led to a vulnerability on Packagist.org and Private Packagist, i.e., using the composer.json readme field as a vector for injecting parameters into the $file argument for the Mercurial driver or via the $identifier argument for the Git and Mercurial drivers.

Composer itself can be attacked through branch names by anyone controlling a Git or Mercurial repository, which is explicitly listed by URL in a project's composer.json.

To the best of our knowledge, this was not actively exploited. The vulnerability has been patched on Packagist.org and Private Packagist within a day of the vulnerability report.

Composer is a dependency manager for the PHP programming language. Integrators using Composer code to call VcsDriver::getFileContent can have a code injection vulnerability if the user can control the $file or $identifier argument. This leads to a vulnerability on packagist.org for example where the composer.json's readme field can be used as a vector for injecting parameters into hg/Mercurial via the $file argument, or git via the $identifier argument if you allow arbitrary data there (Packagist does not, but maybe other integrators do). Composer itself should not be affected by the vulnerability as it does not call getFileContent with arbitrary data into $file/$identifier. To the best of our knowledge this was not abused, and the vulnerability has been patched on packagist.org and Private Packagist within a day of the vulnerability report.

Composer is a dependency manager for the PHP programming language. Integrators using Composer code to call VcsDriver::getFileContent can have a code injection vulnerability if the user can control the $file or $identifier argument. This leads to a vulnerability on packagist.org for example where the composer.json's readme field can be used as a vector for injecting parameters into hg/Mercurial via the $file argument, or git via the $identifier argument if you allow arbitrary data there (Packagist does not, but maybe other integrators do). Composer itself should not be affected by the vulnerability as it does not call getFileContent with arbitrary data into $file/$identifier. To the best of our knowledge this was not abused, and the vulnerability has been patched on packagist.org and Private Packagist within a day of the vulnerability report.

This update for php-composer fixes the following issues:

php-composer was updated to version 1.10.26:

• Security: Fixed command injection vulnerability in HgDriver/GitDriver: CVE-2022-24828 boo#1198494

Update to version 1.10.25

• Fix regression with PHP 8.1.0 and 8.1.1

Update to version 1.10.24

• Fixed PHP 8.1 compatibility

Update to version 1.10.23

• Security: Fixed command injection vulnerability CVE-2021-41116

These are all security issues fixed in the php-composer2-2.3.5-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the php-composer-1.10.26-1.1 package on the GA media of openSUSE Tumbleweed.

This update for php-composer2 fixes the following issues:

• CVE-2022-24828: Fixed a code injection issue that affected integrators using specific APIs to read untrusted input files (bsc#1198494).

This update for php-composer2 fixes the following issues

• CVE-2026-40176: command injection via malicious Perforce repository definition (bsc#1262254).
• CVE-2026-40261: command injection via malicious Perforce source reference/url (bsc#1262255).

Changes for php-composer2:

• version update to 2.2.27 (align with upstream LTS version)

• Security: Hardened git/hg/perforce/fossil identifier validation to ensure branch names starting with - do not cause issues (246f807b, 246f807b, 246f807b)
• Security: Fixed Perforce unescaped user input in queryP4User shell command (246f807b)
• Security: Fixed usage of insecure 3DES ciphers when ext-curl is missing (21ffece62)
• Fixed issue handling paths with = in them on Windows (#11568)

• version 2.2.26 2025-12-30

• Security: Fixed ANSI sequence injection (GHSA-59pp-r3rg-353g / CVE-2025-67746)

• version 2.2.25 2024-12-11

• Fixed deprecation notices appearing on this LTS version in case it is used on modern PHP. Modern PHP support is not guaranteed nor tested for though and the main purpose of LTS releases is legacy PHP versions support. (#12217)
• Fixed issue on plugin upgrade when it defines multiple classes (#12226)
• Fixed duplicate errors appearing in the output depending on php settings (#12214)
• Fixed InstalledVersions returning duplicate data in some instances (#12225)

• version 2.2.24 2024-06-10

• Security: Fixed command injection via malicious git branch name (GHSA-47f6-5gq3-vx9c / CVE-2024-35241)
• Security: Fixed multiple command injections via malicious git/hg branch names (GHSA-v9qv-c7wm-wgmf / CVE-2024-35242)
• Security: Fixed secure-http checks that could be bypassed by using malformed URL formats (fa3b9582c)
• Security: Fixed Filesystem::isLocalPath including windows-specific checks on linux (3c37a67c)
• Security: Fixed perforce argument escaping (3773f775)
• Security: Fixed handling of zip bombs when extracting archives (de5f7e32)
• Security: Fixed Windows command parameter escaping to prevent abuse of unicode characters with best fit encoding
• conversion (3130a7455, 04a63b324)

• version 2.2.23 2024-02-08

• Security: Fixed code execution and possible privilege escalation via compromised vendor dir contents (GHSA-7c6p-848j-wh5h / CVE-2024-24821)

• version 2.2.22 2023-09-29

• Security: Fixed possible remote code execution vulnerability if composer.phar is publicly accessible, executable as PHP, and register_argc_argv is enabled in php.ini (GHSA-jm6m-4632-36hf / CVE-2023-43655)
• Fixed authentication issue when downloading several files from private Bitbucket in parallel (#11464)
• Fixed handling of broken junctions on windows (#11550)
• Fixed loading of root aliases on path repo packages when doing partial updates (#11632)
• Fixed parsing of lib-curl-openssl version with OSX SecureTransport (#11534)
• Fixed binary proxies not being transparent when included by another PHP process and returning a value (#11454)
• Fixed support for plugin classes being marked as readonly (#11404)
• Fixed GitHub rate limit reporting (#11366)
• Fixed issue displaying solver problems with branch names containing % signs (#11359)

• version 2.2.21 2023-02-15

• Fixed extra.plugin-optional support in PluginInstaller when doing pre-install checks (#11326)

• version 2.2.20 2023-02-10

• Added extra.plugin-optional support for allow auto-disabling unknown plugins which are not critical when running non-interactive (#11315)

• version 2.2.19 2023-02-04

• Fixed URL sanitizer to handle new GitHub personal access tokens format (#11137)
• Fixed cache keys to allow _ to avoid conflicts between package names like a-b and a_b (#11229)
• Fixed handling of --ignore-platform-req with upper-bound ignores to not apply to conflict rules (#11037)
• Fixed handling of COMPOSER_DISCARD_CHANGES when set to 0

• version 2.2.18 2022-08-20

• Fixed COMPOSER_NO_DEV so it also works with require and remove's --update-no-dev (#10995)
• Fixed duplicate missing extension warnings being…

Thomas Chauchefoin discovered that Composer did not correctly handle certain arguments. An attacker could possibly use this issue to execute arbitrary code. This issue only affected Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, Ubuntu 20.04 LTS and Ubuntu 22.04 LTS. (CVE-2022-24828, CVE-2023-43655)

Ed Cradock discovered that Composer did not correctly handle the exclusion of certain files. An attacker could possibly use this issue to execute arbitrary code. This issue only affected Ubuntu 22.04 LTS. (CVE-2024-24821)

Martin Haunschmid discovered that Composer did not correctly handle git branch names. An attacker could possibly use this issue to execute arbitrary code. (CVE-2024-35241)

Maciej Piechota discovered that Composer did not correctly handle VCS branch names. An attacker could possibly use this issue to execute arbitrary code. (CVE-2024-35242)