CVE-2022-24828
published 2022-04-13CVE-2022-24828: Composer is a dependency manager for the PHP programming language. Integrators using Composer code to call `VcsDriver::getFileContent` can have a code…
PriorityP349high8.8CVSS 3.1
AVNACLPRNUIRSUCHIHAH
EPSS
1.86%
77.0th percentile
Composer is a dependency manager for the PHP programming language. Integrators using Composer code to call `VcsDriver::getFileContent` can have a code injection vulnerability if the user can control the `$file` or `$identifier` argument. This leads to a vulnerability on packagist.org for example where the composer.json's `readme` field can be used as a vector for injecting parameters into hg/Mercurial via the `$file` argument, or git via the `$identifier` argument if you allow arbitrary data there (Packagist does not, but maybe other integrators do). Composer itself should not be affected by the vulnerability as it does not call `getFileContent` with arbitrary data into `$file`/`$identifier`. To the best of our knowledge this was not abused, and the vulnerability has been patched on packagist.org and Private Packagist within a day of the vulnerability report.
Affected
23 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| composer | composer | < 1.10.26 | 1.10.26 |
| composer | composer | — | — |
| composer | composer | — | — |
| composer | composer | >= 0 < 2.0.9-2+deb11u1 | 2.0.9-2+deb11u1 |
| composer | composer | >= 0 < 2.2.12-1 | 2.2.12-1 |
| composer | composer | >= 0 < 2.2.12-1 | 2.2.12-1 |
| composer | composer | >= 0 < 2.2.12-1 | 2.2.12-1 |
| composer | composer | >= 0 < 1.10.26 | 1.10.26 |
| composer | composer | >= 0 < 1.0.0~beta2-1ubuntu0.1~esm2 | 1.0.0~beta2-1ubuntu0.1~esm2 |
| composer | composer | >= 0 < 1.6.3-1ubuntu0.1~esm2 | 1.6.3-1ubuntu0.1~esm2 |
| composer | composer | >= 0 < 1.10.1-1ubuntu0.1~esm2 | 1.10.1-1ubuntu0.1~esm2 |
| composer | composer | >= 0 < 2.2.6-2ubuntu4+esm1 | 2.2.6-2ubuntu4+esm1 |
| composer | composer | >= 0 < 2.7.1-2ubuntu0.1~esm1 | 2.7.1-2ubuntu0.1~esm1 |
| composer | composer | >= 2.0 < 2.2.12 | 2.2.12 |
| composer | composer | >= 2.3 < 2.3.5 | 2.3.5 |
| debian | composer | < composer 2.2.12-1 (bookworm) | composer 2.2.12-1 (bookworm) |
| fedoraproject | fedora | — | — |
| fedoraproject | fedora | — | — |
| fedoraproject | fedora | — | — |
| getcomposer | composer | < 1.10.26 | 1.10.26 |
| getcomposer | composer | >= 2.0.0 < 2.2.12 | 2.2.12 |
| getcomposer | composer | >= 2.3.0 < 2.3.5 | 2.3.5 |
| tenable | tenable.sc | < 5.21.0 | 5.21.0 |
CVSS provenance
nvdv3.18.8HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
nvdv2.06.8MEDIUMAV:N/AC:M/Au:N/C:P/I:P/A:P
osv8.8HIGH
vendor_debian8.3HIGH
vendor_ubuntu8.3HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
composer vulnerabilities
osv·2025-06-30·CVSS 8.8
CVE-2022-24828 [HIGH] composer vulnerabilities
composer vulnerabilities
Thomas Chauchefoin discovered that Composer did not correctly handle
certain arguments. An attacker could possibly use this issue to execute
arbitrary code. This issue only affected Ubuntu 16.04 LTS,
Ubuntu 18.04 LTS, Ubuntu 20.04 LTS and Ubuntu 22.04 LTS.
(CVE-2022-24828, CVE-2023-43655)
Ed Cradock discovered that Composer did not correctly handle the exclusion
of certain files. An attacker could possibly use this issue to execute
arbitrary code. This issue only affected Ubuntu 22.04 LTS. (CVE-2024-24821)
Martin Haunschmid discovered that Composer did not correctly handle git
branch names. An attacker could possibly use this issue to execute
arbitrary code. (CVE-2024-35241)
Maciej Piechota discovered that Composer did not correctly handle VCS
branch names. An
GHSA
Missing input validation can lead to command execution in composer
ghsa·2022-04-22
CVE-2022-24828 [HIGH] CWE-20 Missing input validation can lead to command execution in composer
Missing input validation can lead to command execution in composer
The Composer method `VcsDriver::getFileContent()` with user-controlled `$file` or `$identifier` arguments is susceptible to an argument injection vulnerability. It can be leveraged to gain arbitrary command execution if the Mercurial or the Git driver are used.
This led to a vulnerability on Packagist.org and Private Packagist, i.e., using the composer.json `readme` field as a vector for injecting parameters into the `$file` argument for the Mercurial driver or via the `$identifier` argument for the Git and Mercurial drivers.
Composer itself can be attacked through branch names by anyone controlling a Git or Mercurial repository, which is explicitly listed by URL in a project's composer.json.
To the best of our knowledg
OSV
Missing input validation can lead to command execution in composer
osv·2022-04-22
CVE-2022-24828 [HIGH] Missing input validation can lead to command execution in composer
Missing input validation can lead to command execution in composer
The Composer method `VcsDriver::getFileContent()` with user-controlled `$file` or `$identifier` arguments is susceptible to an argument injection vulnerability. It can be leveraged to gain arbitrary command execution if the Mercurial or the Git driver are used.
This led to a vulnerability on Packagist.org and Private Packagist, i.e., using the composer.json `readme` field as a vector for injecting parameters into the `$file` argument for the Mercurial driver or via the `$identifier` argument for the Git and Mercurial drivers.
Composer itself can be attacked through branch names by anyone controlling a Git or Mercurial repository, which is explicitly listed by URL in a project's composer.json.
To the best of our knowledg
OSV
CVE-2022-24828: Composer is a dependency manager for the PHP programming language
osv·2022-04-13·CVSS 8.8
CVE-2022-24828 [HIGH] CVE-2022-24828: Composer is a dependency manager for the PHP programming language
Composer is a dependency manager for the PHP programming language. Integrators using Composer code to call `VcsDriver::getFileContent` can have a code injection vulnerability if the user can control the `$file` or `$identifier` argument. This leads to a vulnerability on packagist.org for example where the composer.json's `readme` field can be used as a vector for injecting parameters into hg/Mercurial via the `$file` argument, or git via the `$identifier` argument if you allow arbitrary data there (Packagist does not, but maybe other integrators do). Composer itself should not be affected by the vulnerability as it does not call `getFileContent` with arbitrary data into `$file`/`$identifier`. To the best of our knowledge this was not abused, and the vulnerability has been patched on packag
Ubuntu
Composer vulnerabilities
vendor_ubuntu·2025-06-30·CVSS 8.3
CVE-2024-35241 [HIGH] Composer vulnerabilities
Title: Composer vulnerabilities
Summary: Several security issues were fixed in Composer.
Thomas Chauchefoin discovered that Composer did not correctly handle
certain arguments. An attacker could possibly use this issue to execute
arbitrary code. This issue only affected Ubuntu 16.04 LTS,
Ubuntu 18.04 LTS, Ubuntu 20.04 LTS and Ubuntu 22.04 LTS.
(CVE-2022-24828, CVE-2023-43655)
Ed Cradock discovered that Composer did not correctly handle the exclusion
of certain files. An attacker could possibly use this issue to execute
arbitrary code. This issue only affected Ubuntu 22.04 LTS. (CVE-2024-24821)
Martin Haunschmid discovered that Composer did not correctly handle git
branch names. An attacker could possibly use this issue to execute
arbitrary code. (CVE-2024-35241)
Maciej Piechota discov
Debian
CVE-2022-24828: composer - Composer is a dependency manager for the PHP programming language. Integrators u...
vendor_debian·2022·CVSS 8.3
CVE-2022-24828 [HIGH] CVE-2022-24828: composer - Composer is a dependency manager for the PHP programming language. Integrators u...
Composer is a dependency manager for the PHP programming language. Integrators using Composer code to call `VcsDriver::getFileContent` can have a code injection vulnerability if the user can control the `$file` or `$identifier` argument. This leads to a vulnerability on packagist.org for example where the composer.json's `readme` field can be used as a vector for injecting parameters into hg/Mercurial via the `$file` argument, or git via the `$identifier` argument if you allow arbitrary data there (Packagist does not, but maybe other integrators do). Composer itself should not be affected by the vulnerability as it does not call `getFileContent` with arbitrary data into `$file`/`$identifier`. To the best of our knowledge this was not abused, and the vulnerability has been patched on packag
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
https://github.com/composer/composer/commit/2c40c53637c5c7e43fff7c09d3d324d632734709https://github.com/composer/composer/security/advisories/GHSA-x7cr-6qr6-2hh6https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/625MT3IKWKFVIWLSYZFSXHVUA2LES7YQ/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GWT6LDSRY7SFMTDZWJ4MS2ZBXHL7VQEF/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QD7JQWL6C4GVROO25DTXWYWM6BPOPPCG/https://www.tenable.com/security/tns-2022-09https://github.com/composer/composer/commit/2c40c53637c5c7e43fff7c09d3d324d632734709https://github.com/composer/composer/security/advisories/GHSA-x7cr-6qr6-2hh6https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/625MT3IKWKFVIWLSYZFSXHVUA2LES7YQ/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GWT6LDSRY7SFMTDZWJ4MS2ZBXHL7VQEF/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QD7JQWL6C4GVROO25DTXWYWM6BPOPPCG/https://www.tenable.com/security/tns-2022-09
2022-04-13
Published