Composer is a dependency manager for PHP. Users publishing a composer.phar to a public web-accessible server where the composer.phar can be executed as a php file may be subject to a remote code execution vulnerability if PHP also has `register_argc_argv` enabled in php.ini. Versions 2.6.4, 2.2.22 and 1.10.27 patch this vulnerability. Users are advised to upgrade. Users unable to upgrade should make sure `register_argc_argv` is disabled in php.ini, and avoid publishing composer.phar to the web as this is not best practice.
Metrics
Affected Vendors & Products
| Vendors | Products |
|---|---|
| Debian |
|
| Docker |
|
| Fedoraproject |
|
| Getcomposer |
|
Configuration 1 [-]
|
Configuration 2 [-]
|
No data.
No data.
Advisories
| Source | ID | Title |
|---|---|---|
 Debian DLA |
DLA-3777-1 | composer security update |
 EUVD |
EUVD-2023-2538 | Composer is a dependency manager for PHP. Users publishing a composer.phar to a public web-accessible server where the composer.phar can be executed as a php file may be subject to a remote code execution vulnerability if PHP also has `register_argc_argv` enabled in php.ini. Versions 2.6.4, 2.2.22 and 1.10.27 patch this vulnerability. Users are advised to upgrade. Users unable to upgrade should make sure `register_argc_argv` is disabled in php.ini, and avoid publishing composer.phar to the web as this is not best practice. |
 Github GHSA |
GHSA-jm6m-4632-36hf | Composer Remote Code Execution vulnerability via web-accessible composer.phar |
 Ubuntu USN |
USN-7603-1 | Composer vulnerabilities |
Fixes
Solution
No solution given by the vendor.
Workaround
No workaround given by the vendor.
References
History
Wed, 23 Apr 2025 18:00:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| First Time appeared |
Debian
Debian debian Linux |
|
| CPEs | cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:* | |
| Vendors & Products |
Debian
Debian debian Linux |
Thu, 13 Feb 2025 17:15:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | Composer is a dependency manager for PHP. Users publishing a composer.phar to a public web-accessible server where the composer.phar can be executed as a php file may be subject to a remote code execution vulnerability if PHP also has `register_argc_argv` enabled in php.ini. Versions 2.6.4, 2.2.22 and 1.10.27 patch this vulnerability. Users are advised to upgrade. Users unable to upgrade should make sure `register_argc_argv` is disabled in php.ini, and avoid publishing composer.phar to the web as this is not best practice. | Composer is a dependency manager for PHP. Users publishing a composer.phar to a public web-accessible server where the composer.phar can be executed as a php file may be subject to a remote code execution vulnerability if PHP also has `register_argc_argv` enabled in php.ini. Versions 2.6.4, 2.2.22 and 1.10.27 patch this vulnerability. Users are advised to upgrade. Users unable to upgrade should make sure `register_argc_argv` is disabled in php.ini, and avoid publishing composer.phar to the web as this is not best practice. |
Mon, 23 Sep 2024 17:30:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| First Time appeared |
Docker
Docker composer |
|
| CPEs | cpe:2.3:a:docker:composer:-:*:*:*:*:*:*:* | |
| Vendors & Products |
Docker
Docker composer |
|
| Metrics |
ssvc
|
MITRE
Status: PUBLISHED
Assigner: GitHub_M
Published:
Updated: 2025-06-18T13:59:58.568Z
Reserved: 2023-09-20T15:35:38.147Z
Link: CVE-2023-43655
Vulnrichment
Updated: 2024-08-02T19:44:43.787Z
NVD
Status : Analyzed
Published: 2023-09-29T20:15:09.987
Modified: 2025-04-23T17:31:40.740
Link: CVE-2023-43655
Redhat
No data.
OpenCVE Enrichment
No data.