Description
Composer is a dependency manager for PHP. Users publishing a composer.phar to a public web-accessible server where the composer.phar can be executed as a php file may be subject to a remote code execution vulnerability if PHP also has `register_argc_argv` enabled in php.ini. Versions 2.6.4, 2.2.22 and 1.10.27 patch this vulnerability. Users are advised to upgrade. Users unable to upgrade should make sure `register_argc_argv` is disabled in php.ini, and avoid publishing composer.phar to the web as this is not best practice.
Published: 2023-09-29
Score: 6.4 Medium
EPSS: 2.1% Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Analysis and contextual insights are available on OpenCVE Cloud.

Remediation

No vendor fix or workaround currently provided.

Additional remediation guidance may be available on OpenCVE Cloud.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Debian DLA Debian DLA DLA-3777-1 composer security update
EUVD EUVD EUVD-2023-2538 Composer is a dependency manager for PHP. Users publishing a composer.phar to a public web-accessible server where the composer.phar can be executed as a php file may be subject to a remote code execution vulnerability if PHP also has `register_argc_argv` enabled in php.ini. Versions 2.6.4, 2.2.22 and 1.10.27 patch this vulnerability. Users are advised to upgrade. Users unable to upgrade should make sure `register_argc_argv` is disabled in php.ini, and avoid publishing composer.phar to the web as this is not best practice.
Github GHSA Github GHSA GHSA-jm6m-4632-36hf Composer Remote Code Execution vulnerability via web-accessible composer.phar
Ubuntu USN Ubuntu USN USN-7603-1 Composer vulnerabilities
History

Wed, 23 Apr 2025 18:00:00 +0000

Type Values Removed Values Added
First Time appeared Debian
Debian debian Linux
CPEs cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*
Vendors & Products Debian
Debian debian Linux

Thu, 13 Feb 2025 17:15:00 +0000

Type Values Removed Values Added
Description Composer is a dependency manager for PHP. Users publishing a composer.phar to a public web-accessible server where the composer.phar can be executed as a php file may be subject to a remote code execution vulnerability if PHP also has `register_argc_argv` enabled in php.ini. Versions 2.6.4, 2.2.22 and 1.10.27 patch this vulnerability. Users are advised to upgrade. Users unable to upgrade should make sure `register_argc_argv` is disabled in php.ini, and avoid publishing composer.phar to the web as this is not best practice. Composer is a dependency manager for PHP. Users publishing a composer.phar to a public web-accessible server where the composer.phar can be executed as a php file may be subject to a remote code execution vulnerability if PHP also has `register_argc_argv` enabled in php.ini. Versions 2.6.4, 2.2.22 and 1.10.27 patch this vulnerability. Users are advised to upgrade. Users unable to upgrade should make sure `register_argc_argv` is disabled in php.ini, and avoid publishing composer.phar to the web as this is not best practice.

Mon, 23 Sep 2024 17:30:00 +0000

Type Values Removed Values Added
First Time appeared Docker
Docker composer
CPEs cpe:2.3:a:docker:composer:-:*:*:*:*:*:*:*
Vendors & Products Docker
Docker composer
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Subscriptions

Debian Debian Linux
Docker Composer
Fedoraproject Fedora
Getcomposer Composer
cve-icon MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published:

Updated: 2025-06-18T13:59:58.568Z

Reserved: 2023-09-20T15:35:38.147Z

Link: CVE-2023-43655

cve-icon Vulnrichment

Updated: 2024-08-02T19:44:43.787Z

cve-icon NVD

Status : Analyzed

Published: 2023-09-29T20:15:09.987

Modified: 2025-04-23T17:31:40.740

Link: CVE-2023-43655

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

No data.

Weaknesses