title: Remote Code Execution via web-accessible composer.phar
description: Composer is a dependency manager for PHP. Users publishing a composer.phar to a public web-accessible server where the composer.phar can be executed as a php file may be subject to a remote code execution vulnerability if PHP also has `register_argc_argv` enabled in php.ini. Versions 2.6.4, 2.2.22 and 1.10.27 patch this vulnerability. Users are advised to upgrade. Users unable to upgrade should make sure `register_argc_argv` is disabled in php.ini, and avoid publishing composer.phar to the web as this is not best practice.
problem types: CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
affected:
{
vendor: composer
product: composer
versions:
version: 2.6.4, 2.2.21, 1.10.27, status: affected
version: >= 2.0, < 2.2.22, status: affected
version: < 1.10.27, status: affected
}
metrics:
cvssV3_1: [
attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 6.4
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: HIGH
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H
version: 3.1
]