PT-2026-22108 · Packistry · Packistry

Maantje · Published 2026-02-26 · Updated 2026-02-26 · CVE-2026-27968

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Packistry versions prior to 0.13.0

Description Packistry is a self-hosted Composer repository for PHP package distribution. Prior to version 0.13.0, the RepositoryAwareController::authorize() function did not enforce token expiration, allowing expired deploy tokens with the correct ability to access repository endpoints, such as Composer metadata and download APIs. The fix in version 0.13.0 adds an explicit expiration check to the authorize() function, and tests now verify that expired deploy tokens are rejected.

Recommendations Update to version 0.13.0 or later.

Exploit

Fix

Insufficient Session Expiration

Improper Authentication

Weakness Enumeration

CWE-613

CWE-287

Related Identifiers

CVE-2026-27968

GHSA-4R9M-JP53-VGMW

Affected Products

Packistry

References · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/27xxx/CVE-2026-27968.json · Exploit
• https://github.com/packistry/packistry/pull/276 · Patch
• https://github.com/packistry/packistry/commit/7740b48f0f4ecbe63099fb056c8a146180f8b283 · Patch
• https://github.com/packistry/packistry/security/advisories/GHSA-4r9m-jp53-vgmw · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-27968 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-27968 · Security Note
• https://twitter.com/CVEnew/status/2027004209111990636 · Twitter Post
• https://t.me/CVEtracker/45811 · Telegram Post