Composer is a dependency manager for PHP. Users publishing a composer.phar to a public web-accessible server where the composer.phar can be executed as a php file may be subject to a remote code execution vulnerability if PHP also has `register_argc_argv` enabled in php.ini. Versions 2.6.4, 2.2.22 and 1.10.27 patch this vulnerability. Users are advised to upgrade. Users unable to upgrade should make sure `register_argc_argv` is disabled in php.ini, and avoid publishing composer.phar to the web as this is not best practice.

No CVSS v4.0

Attack Vector Network

Attack Complexity High

Privileges Required High

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction Required

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.01891.

Exploitation none

Automatable no

Technical Impact total

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions
composer composer affected
Version Status Constraints
2.6.4, 2.2.21, 1.10.27 affected —
>= 2.0, < 2.2.22 affected —
< 1.10.27 affected —

Configuration 1 [-]

OR cpe:2.3:a:getcomposer:composer:*:*:*:*:*:*:*:*
cpe:2.3:a:getcomposer:composer:*:*:*:*:*:*:*:*
cpe:2.3:a:getcomposer:composer:*:*:*:*:*:*:*:*

Configuration 2 [-]

OR cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*
cpe:2.3:o:fedoraproject:fedora:37:*:*:*:*:*:*:*
cpe:2.3:o:fedoraproject:fedora:38:*:*:*:*:*:*:*

No data.

No data.

Project Subscriptions

Vendors Products
Debian Subscribe
Debian Linux Subscribe
Docker Subscribe
Composer Subscribe
Fedoraproject Subscribe
Fedora Subscribe
Getcomposer Subscribe
Composer Subscribe
Advisories
Source ID Title
Debian DLA Debian DLA DLA-3777-1 composer security update
EUVD EUVD EUVD-2023-2538 Composer is a dependency manager for PHP. Users publishing a composer.phar to a public web-accessible server where the composer.phar can be executed as a php file may be subject to a remote code execution vulnerability if PHP also has `register_argc_argv` enabled in php.ini. Versions 2.6.4, 2.2.22 and 1.10.27 patch this vulnerability. Users are advised to upgrade. Users unable to upgrade should make sure `register_argc_argv` is disabled in php.ini, and avoid publishing composer.phar to the web as this is not best practice.
Github GHSA Github GHSA GHSA-jm6m-4632-36hf Composer Remote Code Execution vulnerability via web-accessible composer.phar
Ubuntu USN Ubuntu USN USN-7603-1 Composer vulnerabilities
Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References
Link Providers
https://github.com/composer/composer/commit/4fce14795aba98e40b6c4f5047305aba17a6120d cve-icon cve-icon
https://github.com/composer/composer/commit/955a48e6319c8962e5cd421b07c00ab3c728968c cve-icon cve-icon
https://github.com/composer/composer/commit/95e091c921037b7b6564942845e7b738f6b95c9c cve-icon cve-icon
https://github.com/composer/composer/security/advisories/GHSA-jm6m-4632-36hf cve-icon cve-icon
https://lists.debian.org/debian-lts-announce/2024/03/msg00030.html cve-icon cve-icon
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/66H2WKFUO255T3BZTL72TNYJYH2XM5FG/ cve-icon cve-icon
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/7AWYAUZNH565NWPIKGEIYBWHYNM5JGAE/ cve-icon cve-icon
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KFOPGPW2KS37O3KJWBRGTUWHTXCQXBS2/ cve-icon cve-icon
History

Wed, 23 Apr 2025 18:00:00 +0000

Type Values Removed Values Added
First Time appeared Debian
Debian debian Linux
CPEs cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*
Vendors & Products Debian
Debian debian Linux

Thu, 13 Feb 2025 17:15:00 +0000

Type Values Removed Values Added
Description Composer is a dependency manager for PHP. Users publishing a composer.phar to a public web-accessible server where the composer.phar can be executed as a php file may be subject to a remote code execution vulnerability if PHP also has `register_argc_argv` enabled in php.ini. Versions 2.6.4, 2.2.22 and 1.10.27 patch this vulnerability. Users are advised to upgrade. Users unable to upgrade should make sure `register_argc_argv` is disabled in php.ini, and avoid publishing composer.phar to the web as this is not best practice. Composer is a dependency manager for PHP. Users publishing a composer.phar to a public web-accessible server where the composer.phar can be executed as a php file may be subject to a remote code execution vulnerability if PHP also has `register_argc_argv` enabled in php.ini. Versions 2.6.4, 2.2.22 and 1.10.27 patch this vulnerability. Users are advised to upgrade. Users unable to upgrade should make sure `register_argc_argv` is disabled in php.ini, and avoid publishing composer.phar to the web as this is not best practice.

Mon, 23 Sep 2024 17:30:00 +0000

Type Values Removed Values Added
First Time appeared Docker
Docker composer
CPEs cpe:2.3:a:docker:composer:-:*:*:*:*:*:*:*
Vendors & Products Docker
Docker composer
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Projects

Sign in to view the affected projects.

cve-icon MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published:

Updated: 2025-06-18T13:59:58.568Z

Reserved: 2023-09-20T15:35:38.147Z

Link: CVE-2023-43655

cve-icon Vulnrichment

Updated: 2024-08-02T19:44:43.787Z

cve-icon NVD

Status : Analyzed

Published: 2023-09-29T20:15:09.987

Modified: 2025-04-23T17:31:40.740

Link: CVE-2023-43655

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

No data.

Weaknesses