PT-2026-32621 · Composer · Composer

Published 2026-04-14 · Updated 2026-05-06 · CVE-2026-40176

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Composer versions 1.0 through 2.2.26 Composer versions 2.3 through 2.9.5

Description A command injection issue exists in the Perforce VCS driver of Composer, a dependency manager for PHP. The Perforce::generateP4Command() function constructs shell commands by interpolating user-supplied Perforce connection parameters without proper escaping. An attacker can inject arbitrary commands through the port, user, or client variables within a malicious 'composer.json' file that declares a Perforce VCS repository. This allows for arbitrary command execution in the context of the user running Composer, regardless of whether Perforce is installed on the system. This issue can be triggered when running Composer commands on untrusted projects. VCS repositories are only loaded from the root 'composer.json' or the composer config directory, meaning it cannot be exploited via dependency packages.

Recommendations Update to version 2.2.27 for versions 1.0 through 2.2.26. Update to version 2.9.6 for versions 2.3 through 2.9.5. Only run Composer commands on projects from trusted sources. Carefully inspect 'composer.json' files to verify that Perforce-related fields contain valid values before execution.

Exploit

Fix

RCE

OS Command Injection

Weakness Enumeration

CWE-20

CWE-78

Related Identifiers

BDU:2026-05521

BIT-COMPOSER-2026-40176

CVE-2026-40176

GHSA-WG36-WVJ6-R67P

OPENSUSE-SU-2026:10643-1

RHSA-2026:8165

Affected Products

Composer

References · 41

• 🔥 https://github.com/FriendsOfPHP/security-advisories/blob/master/composer/composer/CVE-2026-40176.yaml · Exploit
• 🔥 https://github.com/terminat0r7031/composer-CVE-2026-40261-CVE-2026-40176-PoC · Exploit
• https://github.com/composer/composer/security/advisories/GHSA-wg36-wvj6-r67p · Vendor Advisory
• https://bdu.fstec.ru/vul/2026-05521 · Security Note
• https://osv.dev/vulnerability/GHSA-wg36-wvj6-r67p · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2026-40176 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-40176 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-40176 · Security Note
• https://ubuntu.com/security/CVE-2026-40176 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-40176 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-40176 · Security Note
• https://osv.dev/vulnerability/BIT-composer-2026-40176 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2026:10643-1 · Vendor Advisory
• https://github.com/composer/composer · Note
• https://github.com/composer/composer/releases/tag/2.9.6 · Note