Composer’s bin definition field may contain ".." path segments that, when evaluated during installation, expansion, or required processing, resolve to locations outside the package installation directory. This path traversal flaw (CWE‑22) combined with improper permission handling (CWE‑732) allows Composer to chmod an arbitrary host file to world‑readable and world‑executable, effectively modifying existing file permissions on the host system.

Any system running Composer lower than versions 2.2.29 or 2.10.2 is vulnerable whenever a Composer package supplies a bin entry with ".." segments. The affected product is the composer:composer package; developers, continuous integration pipelines, and production servers that install PHP dependencies from potentially untrusted sources are all at risk.

The CVSS score of 6.1 indicates moderate potential impact, while the EPSS score of < 1% reflects a low probability of exploitation. The vulnerability is not listed in CISA KEV. Based on the description, it is inferred that an attacker could deliver a malicious Composer package through a repository (such as Packagist or a private repository) so that Composer processes it. The exploit requires that the Composer process have permission to change file modes on the host. The vulnerability does not grant arbitrary code execution but can lead to unintended exposure or modification of file permissions, which could serve as a foothold for further compromise.