openSUSE-SU-2026:21520-1

See a problem?
Import Source
https://ftp.suse.com/pub/projects/security/osv/openSUSE-SU-2026:21520-1.json
JSON Data
https://api.test.osv.dev/v1/vulns/openSUSE-SU-2026:21520-1
Upstream
Related
Published
2026-08-03T21:09:33Z
Modified
2026-08-05T18:23:40.408372409Z
Summary
Security update for php-composer2
Details

This update for php-composer2 fixes the following issues:

  • CVE-2026-45793: Github Actions issued GITHUB_TOKEN disclosure in GitHub Actions logs (bsc#1271504).
  • CVE-2026-59946: path traversal in package bin field lets dependencies chmod arbitrary host files (bsc#1271151).
  • CVE-2026-59947: URL-embedded HTTP-Basic username leaks to verbose logs (bsc#1271129).
  • CVE-2026-59948: arbitrary file write outside vendordirectory via malicious transitive package name (bsc#1271122).

Changes for php-composer2:

  • fix byte-swapped signature on s390x can cause broken or unsupported signature (bsc#1271729).
References

Affected packages

openSUSE:Leap 16.0 / php-composer2

Package

Name
php-composer2
Purl
pkg:rpm/opensuse/php-composer2&distro=openSUSE%20Leap%2016.0

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
2.8.9-160000.4.1

Ecosystem specific 

{
    "binaries": [
        {
            "php-composer2": "2.8.9-160000.4.1"
        }
    ]
}

Database specific

source 
"https://ftp.suse.com/pub/projects/security/osv/openSUSE-SU-2026:21520-1.json"