PT-2026-22108 · Packistry · Packistry

Maantje · Publicado 2026-02-26 · Atualizado 2026-02-26 · CVE-2026-27968

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Média

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Packistry versions prior to 0.13.0

Description Packistry is a self-hosted Composer repository for PHP package distribution. Prior to version 0.13.0, the RepositoryAwareController::authorize() function did not enforce token expiration, allowing expired deploy tokens with the correct ability to access repository endpoints, such as Composer metadata and download APIs. The fix in version 0.13.0 adds an explicit expiration check to the authorize() function, and tests now verify that expired deploy tokens are rejected.

Recommendations Update to version 0.13.0 or later.

Exploit

Correção

Insufficient Session Expiration

Improper Authentication

Enumeração de Fraquezas

CWE-613

CWE-287

Identificadores relacionados

CVE-2026-27968

GHSA-4R9M-JP53-VGMW

Produtos afetados

Packistry

Referências · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/27xxx/CVE-2026-27968.json · Exploit
• https://github.com/packistry/packistry/pull/276 · Correção
• https://github.com/packistry/packistry/commit/7740b48f0f4ecbe63099fb056c8a146180f8b283 · Correção
• https://github.com/packistry/packistry/security/advisories/GHSA-4r9m-jp53-vgmw · Aviso do Fabricante
• https://twitter.com/CVEnew/status/2027004209111990636 · Publicação no Twitter
• https://t.me/CVEtracker/45811 · Publicação no Telegram
• https://osv.dev/vulnerability/CVE-2026-27968 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2026-27968 · Nota de Segurança