Description
Composer is a dependency manager for PHP. Users publishing a composer.phar to a public web-accessible server where the composer.phar can be executed as a php file may be subject to a remote code execution vulnerability if PHP also has `register_argc_argv` enabled in php.ini. Versions 2.6.4, 2.2.22 and 1.10.27 patch this vulnerability. Users are advised to upgrade. Users unable to upgrade should make sure `register_argc_argv` is disabled in php.ini, and avoid publishing composer.phar to the web as this is not best practice.
Published: 2023-09-29
Score: 6.4 Medium
EPSS: 2.1% Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

No analysis available yet.

Remediation

No remediation available yet.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Debian DLA Debian DLA DLA-3777-1 composer security update
EUVD EUVD EUVD-2023-2538 Composer is a dependency manager for PHP. Users publishing a composer.phar to a public web-accessible server where the composer.phar can be executed as a php file may be subject to a remote code execution vulnerability if PHP also has `register_argc_argv` enabled in php.ini. Versions 2.6.4, 2.2.22 and 1.10.27 patch this vulnerability. Users are advised to upgrade. Users unable to upgrade should make sure `register_argc_argv` is disabled in php.ini, and avoid publishing composer.phar to the web as this is not best practice.
Github GHSA Github GHSA GHSA-jm6m-4632-36hf Composer Remote Code Execution vulnerability via web-accessible composer.phar
Ubuntu USN Ubuntu USN USN-7603-1 Composer vulnerabilities
History

Wed, 23 Apr 2025 18:00:00 +0000

Type Values Removed Values Added
First Time appeared Debian
Debian debian Linux
CPEs cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*
Vendors & Products Debian
Debian debian Linux

Thu, 13 Feb 2025 17:15:00 +0000

Type Values Removed Values Added
Description Composer is a dependency manager for PHP. Users publishing a composer.phar to a public web-accessible server where the composer.phar can be executed as a php file may be subject to a remote code execution vulnerability if PHP also has `register_argc_argv` enabled in php.ini. Versions 2.6.4, 2.2.22 and 1.10.27 patch this vulnerability. Users are advised to upgrade. Users unable to upgrade should make sure `register_argc_argv` is disabled in php.ini, and avoid publishing composer.phar to the web as this is not best practice. Composer is a dependency manager for PHP. Users publishing a composer.phar to a public web-accessible server where the composer.phar can be executed as a php file may be subject to a remote code execution vulnerability if PHP also has `register_argc_argv` enabled in php.ini. Versions 2.6.4, 2.2.22 and 1.10.27 patch this vulnerability. Users are advised to upgrade. Users unable to upgrade should make sure `register_argc_argv` is disabled in php.ini, and avoid publishing composer.phar to the web as this is not best practice.

Mon, 23 Sep 2024 17:30:00 +0000

Type Values Removed Values Added
First Time appeared Docker
Docker composer
CPEs cpe:2.3:a:docker:composer:-:*:*:*:*:*:*:*
Vendors & Products Docker
Docker composer
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Subscriptions

Debian Debian Linux
Docker Composer
Fedoraproject Fedora
Getcomposer Composer
cve-icon MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published:

Updated: 2025-06-18T13:59:58.568Z

Reserved: 2023-09-20T15:35:38.147Z

Link: CVE-2023-43655

cve-icon Vulnrichment

Updated: 2024-08-02T19:44:43.787Z

cve-icon NVD

Status : Analyzed

Published: 2023-09-29T20:15:09.987

Modified: 2025-04-23T17:31:40.740

Link: CVE-2023-43655

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

No data.

Weaknesses