Composer is the quiet kitchen porter of the PHP world. Nobody thanks it, everybody depends on it, and every Drupal site you've ever loved was assembled by it. So when Composer turns out to have a soft spot in how it handles packages, it's worth putting down the cake and paying attention.

A Fix That Needed Its Own Fix

CVE-2026-59944, published October 2, is a path traversal and symlink-following flaw in Composer. A malicious or compromised package can declare one of its binaries as a symbolic link that points outside its own package directory. Composer may then change the permissions on that outside file and create a runnable vendor/bin proxy pointing at it. On shared hosts, that can expose sensitive data that was never supposed to be readable.

The awkward part is that this bypasses an earlier security fix (GHSA-gjfg-22fp-rrxx). That fix only rejected literal .. path segments and ran in a single place during dependency resolution. Symlinks walked right around it. Affected versions are 1.0.0 through 2.2.29 and 2.3.0 through 2.10.2. The fixes are in Composer 2.10.3 and the 2.2 LTS release 2.2.30. It's rated CVSS 6.1 (Medium).

Why Drupal Shops Should Care

As The DropTimes pointed out, the vulnerable versions include ones that still meet Drupal 11's minimum Composer requirement. In other words, "my site meets the requirements" and "my site is patched" are two different statements right now. Drupal's whole modern build process runs through Composer, so this isn't some obscure side tool. It's the front door.

The angle most people miss is that the real danger isn't on your laptop. It's in your pipeline. The most realistic risk is in CI/CD and deployment environments: vendor directories restored from shared or untrusted CI caches, copied from earlier container build stages, or left writable by lower-trust build steps. A "Medium" score can do High damage when it lives inside the machine that builds every release you ship. The recommended fix is to upgrade Composer and then rebuild dependency state from trusted sources. Don't just bump the version and keep a cache that might already be tainted.

Supply-chain security is a lot like food safety: one spoiled ingredient ruins the whole dish, no matter how good the recipe is.

If this one has you side-eyeing your build pipeline, grab our free developer's checklist for defending against supply-chain attacks. It's the same list we use when auditing Drupal deployments.

Source: GitLab Advisory Database (via The DropTimes)