Directory Traversal Affecting composer package, versions *
Threat Intelligence
The probability is the direct output of the EPSS model, and conveys an overall sense of the threat of exploitation in the wild. The percentile measures the EPSS probability relative to all known EPSS scores. Note: This data is updated daily, relying on the latest available EPSS model version. Check out the EPSS documentation for more details.
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk IDSNYK-ECHOLATEST-COMPOSER-19427091
- published29 Aug 2026
- disclosed16 Sept 2026
Introduced: 29 Aug 2026
CVE-2026-59944 (opens in a new tab)How to fix?
There is no fixed version for Echo:latest composer.
NVD Description
Note: Versions mentioned in the description apply only to the upstream composer package and not the composer package as distributed by Echo.
See How to fix? for Echo:latest relevant fixed versions and status.
Composer is a dependency Manager for the PHP language. From 1.0 until 2.2.30 and from 2.3.0 until 2.10.3, a malicious or compromised dependency can bypass the earlier CVE-2026-59946 binary-path hardening because Composer validates literal parent-directory segments only during dependency resolution, while the symlink and installed-metadata paths described by the advisory skip that validation. A package can ship an in-package binary symlink that resolves outside its installation directory, or attacker-influenced vendor/composer/installed.json metadata can provide an escaping binary path during a reinstall or regeneration of missing vendor/bin entries. The installed-metadata path is reachable only when the vendor directory was not populated by the same validated install run, such as when it is restored from an untrusted cache, copied from an earlier build stage, carried over from an older Composer run, or writable by a lower-trust build step. Composer can follow the path, change the external target's permissions to make it world-readable and executable, and create a runnable vendor/bin proxy to that external file. The issue does not directly read or transmit data and does not by itself provide remote code execution. This issue is fixed in versions 2.2.30 and 2.10.3.
References
- https://advisory.echohq.com/cve/CVE-2026-59944
- https://github.com/composer/composer/commit/53b8bb4c24697b2f00a18cf1ef35a10392701b89
- https://github.com/composer/composer/commit/ad649fdfdf8ed826d4a34e0e5690c76a0b4833aa
- https://github.com/composer/composer/releases/tag/2.10.3
- https://github.com/composer/composer/releases/tag/2.2.30
- https://github.com/composer/composer/security/advisories/GHSA-96h3-5x6v-m776