Composer fixes path traversal and token leak flaws in new releases

Maintainers of the PHP dependency manager Composer disclosed two vulnerabilities on 29 October 2026, affecting all releases prior to 2.2.31 and prior to 2.11.0. The issues are tracked as GHSA-c968-33g3-wh7p (path traversal) and GHSA-fm2w-xgf2-f9fh (token disclosure), with patched releases 2.11.0 and 2.2.31 (LTS) announced as fixes. The advisory notes that both flaws were reported by euriconicacio and Saku0512, respectively. No public PoC exploits or active exploitation in the wild are confirmed in the report.

The path traversal flaw relies on locally trusted package names stored in vendor/composer/installed.json. According to the advisory, if an attacker corrupts that file to include a package name containing .. path segments, a subsequent composer install can delete a directory outside the vendor folder. A reinstall can also write the package’s files to the external path with the user’s privileges.

The token disclosure flaw arises when a composer-type repository is configured with inline HTTP headers in global config.json; Composer copies those headers into composer[.]lock under transport-options for every downloaded package. If such lock files are committed or published, embedded API tokens or credentials can be exposed. Credentials in auth.json or COMPOSER_AUTH are not affected.

Affected versions are all releases from 1.0 up to 2.2.30, and from 2.3.0 up to 2.10.9. Remediation requires upgrading to Composer 2.11.0 or 2.2.31 (LTS) and running composer update –lock to purge previously written headers. Organisations that shared affected lock files should inspect Git history for transport-options entries and revoke exposed tokens, migrating inline credentials to auth.json.