FreeBSD VuXML: Documenting security issues in FreeBSD and the FreeBSD Ports Collection

PHP Composer -- Multiple vulnerabilities

Affected packages
	php82-composer	<	2.10.3
	php83-composer	<	2.10.3
	php84-composer	<	2.10.3
	php85-composer	<	2.10.3

Details

VuXML ID	db135cd1-a232-11f1-85ed-10ffe07f9334
Discovery	2026-08-27
Entry	2026-08-27

Composer project reports:

Validate package bin paths against path traversal using symlinks (GHSA-96h3-5x6v-m776, CVE-2026-59944)

Fixed command injection via malicious Perforce url (GHSA-rvx4-ffvw-m9q3)

[source]

References

CVE Name	CVE-2026-59944
URL	https://github.com/composer/composer/security/advisories/GHSA-96h3-5x6v-m776
URL	https://github.com/composer/composer/security/advisories/GHSA-rvx4-ffvw-m9q3