Composer, the PHP dependency manager, has a flaw that allows an attacker to cause the tool to write files outside the vendor directory and project root. Based on the description, it is inferred that the vulnerability originates from an invalid package name that is not correctly validated during dependency resolution, enabling a path traversal error and an out‑of‑bounds write. This leads to arbitrary file overwrite or creation, which could be used to inject malicious code or corrupt existing files, as indicated by the associated CWEs—CWE‑22 (Path Traversal) and CWE‑787 (Out‑of‑Bounds Write).

The public Composer package (composer:composer) is affected in all releases prior to 2.2.29 and 2.10.2. Projects that pull dependencies from any repository other than Packagist.org or Private Packagist are potentially vulnerable, regardless of the PHP version or OS.

The CVSS score of 7 indicates moderate severity, while the EPSS score of fewer than 1 % implies a low current exploitation probability. The vulnerability is not listed in the CISA KEV catalog. Attackers can exploit the flaw during a composer install or update when a project includes a malicious transitive package from an untrusted repository. By manipulating a package name, the attacker can force Composer to write to locations outside the vendor directory, potentially enabling code execution or destructive tampering of project files.