Composer's bin field can include ".." segments that, when processed during install, update, or require, resolve outside the intended package directory and allow Composer to chmod an arbitrary host file to world‑readable and world‑executable. This path traversal weakness (CWE‑22) combined with improper permission handling (CWE‑732) permits an attacker to alter existing file permissions on the host, potentially exposing sensitive data or enabling execution of code.

Any system running Composer before versions 2.2.29 or 2.10.2 is vulnerable when a malicious dependency supplies a bin entry containing ".." path segments. The affected product is the composer:composer package, and the risk applies to developers, CI pipelines, and servers that install PHP dependencies from public or private repositories.

The CVSS score of 6.1 reflects moderate potential impact, while an EPSS score of < 1% indicates a low probability of exploitation; the vulnerability is not listed in the CISA KEV catalog. Exploitation would involve an attacker delivering a malicious Composer package—typically through Packagist or a private repository—so that Composer processes it. The attacker must have Composer run in an environment where the process has permission to change file modes on the host; the vulnerability does not grant arbitrary code execution but can expose or modify existing files, creating a secondary opportunity for compromise.