{"vulnerability": "CVE-2026-5994", "sightings": [{"uuid": "0cd272a7-5ebf-4e7f-baab-e83d280b1e04", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-5994", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mj4ct7u4dc2o", "content": "", "creation_timestamp": "2026-04-10T02:50:33.889581Z"}, {"uuid": "c2c292e5-2a8a-43e1-bd80-4afdd1cb033c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-5994", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mj4k4hr7cj2p", "content": "", "creation_timestamp": "2026-04-10T05:01:00.851666Z"}, {"uuid": "d30d493a-8506-484c-9ccd-b350e0e5ba6b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-5994", "type": "seen", "source": "https://infosec.exchange/users/offseq/statuses/116378883078030003", "content": "", "creation_timestamp": "2026-04-10T06:00:28.929190Z"}, {"uuid": "489203a5-2580-4c18-b8f4-d0f680c9731c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-5994", "type": "seen", "source": "https://bsky.app/profile/offseq.bsky.social/post/3mj4ngufut62y", "content": "", "creation_timestamp": "2026-04-10T06:00:31.342162Z"}, {"uuid": "513bfd56-414c-4d79-83fc-2a0b982517e5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-5994", "type": "published-proof-of-concept", "source": "Telegram/Fvik4eX2xz-nzJuB7IaHT1kkv6IwgWipFYk1oHJ2HiAA0EI", "content": "", "creation_timestamp": "2026-04-10T03:17:30.000000Z"}, {"uuid": "363659aa-9449-4100-bb61-27107dd244c9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-59948", "type": "seen", "source": "https://bsky.app/profile/securityonline.bsky.social/post/3mqmcwqc74x2m", "content": "PHP Composer patched three flaws, including CVE-2026-59948, an arbitrary file write that can run code outside your project. Update to 2.10.2 or 2.2.29.\n\n#PHPComposer #Composer #ArbitraryFileWrite #SupplyChain #CVE #PHP #DevSecOps #InfoSec", "creation_timestamp": "2026-07-14T13:31:29.749020Z"}, {"uuid": "c7d5cfaa-2b53-4b0b-86d6-3c8ada13bf30", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-59948", "type": "seen", "source": "https://bsky.app/profile/kitafox.bsky.social/post/3mqofbaoful27", "content": "CVE-2026-59948: PHP Composer\u306e\u8106\u5f31\u6027\u306b\u3088\u308a\u3001\u30d1\u30c3\u30b1\u30fc\u30b8\u304c\u30d7\u30ed\u30b8\u30a7\u30af\u30c8\u30b3\u30f3\u30c6\u30ad\u30b9\u30c8\u5916\u3067\u30b3\u30fc\u30c9\u3092\u5b9f\u884c\u3067\u304d\u308b \n\nCVE-2026-59948: PHP Composer Flaw Lets Packages Execute Code Outside the Project Context  #DailyCyberSecurity (Jul 14)\n\nsecurityonline.info/php-composer...", "creation_timestamp": "2026-07-15T09:18:28.821063Z"}, {"uuid": "53f446db-f874-4c52-b8fa-bbb843a6f2f3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-59948", "type": "seen", "source": "https://gist.github.com/alon710/4520df6a85d072915e787e3825f8e5ef", "content": "# CVE-2026-59948: CVE-2026-59948: Path Traversal and Arbitrary File Write in Composer Dependency Resolution\n\n> **CVSS Score:** 7.0\n> **Published:** 2026-07-20\n> **Full Report:** https://cvereports.com/reports/CVE-2026-59948\n\n## Summary\nCVE-2026-59948 is a high-severity path traversal and arbitrary file write vulnerability in the Composer dependency manager for PHP. When resolving package dependencies from custom, untrusted repositories, vulnerable versions fail to validate critical metadata like package names, source/dist URLs, and binary paths. An attacker who controls a third-party repository can serve a malicious package structure that escapes the 'vendor/' folder, enabling arbitrary file creation, option injection in VCS commands, and potential local execution.\n\n## TL;DR\nComposer versions prior to 2.2.29 and 2.10.2 do not validate metadata from untrusted repositories during dependency resolution, permitting path traversal, arbitrary file writes outside the project directory, and argument injection.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-22 (Path Traversal), CWE-787 (Out-of-bounds Write)\n- **Attack Vector**: Local (Requires user interaction to run Composer commands)\n- **CVSS Score**: 7.0 (High)\n- **EPSS Score**: 0.00132 (Percentile: 3.13%)\n- **Impact**: Arbitrary File Write, Remote Code Execution (RCE) via path traversal\n- **Exploit Status**: Proof-of-Concept via unit tests, no active exploitation\n- **KEV Status**: Not Listed\n\n## Affected Systems\n\n- Composer (PHP Dependency Manager)\n- **Composer**: >= 1.0, < 2.2.29 (Fixed in: `2.2.29`)\n- **Composer**: >= 2.3.0, < 2.10.2 (Fixed in: `2.10.2`)\n\n## Mitigation\n\n- Upgrade Composer to fixed versions 2.2.29 or 2.10.2\n- Restrict configuration of untrusted third-party repositories\n- Run Composer processes inside low-privilege isolated container environments\n\n**Remediation Steps:**\n1. Verify the running version of Composer using 'composer --version'\n2. Execute 'composer self-update --stable' to update to the latest patched version\n3. Ensure custom repositories in composer.json are audited and trusted\n4. Implement 'composer audit' in automated CI/CD pipelines\n\n## References\n\n- [GitHub Security Advisory GHSA-499r-g7pc-vmp9](https://github.com/composer/composer/security/advisories/GHSA-499r-g7pc-vmp9)\n- [CVE-2026-59948 on CVE.org](https://www.cve.org/CVERecord?id=CVE-2026-59948)\n- [NVD Vulnerability Details](https://nvd.nist.gov/vuln/detail/CVE-2026-59948)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-59948) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-07-20T20:32:00.184491Z"}, {"uuid": "aceb46dc-92bc-40fd-99a3-79086d6d3a6c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-59943", "type": "published-proof-of-concept", "source": "https://github.com/dompdf/dompdf/security/advisories/GHSA-j8qw-6jw8-r297", "content": "", "creation_timestamp": "2026-07-23T00:35:05.377845Z"}, {"uuid": "c5a79ea2-cc6a-4528-b176-cefbf7854aef", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-59942", "type": "published-proof-of-concept", "source": "https://github.com/dompdf/dompdf/security/advisories/GHSA-f5gf-2cj8-52g2", "content": "", "creation_timestamp": "2026-07-23T00:35:07.687625Z"}, {"uuid": "c7ca8cd1-8f32-4260-9cd8-41c3935a3b4e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-59941", "type": "published-proof-of-concept", "source": "https://github.com/dompdf/dompdf/security/advisories/GHSA-8hg6-c449-896m", "content": "", "creation_timestamp": "2026-07-23T00:35:10.062119Z"}]}