SUSE-SU-2026:23116-1
- Source
- https://www.suse.com/support/update/announcement/2026/suse-su-202623116-1/
- Import Source
- https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:23116-1.json
- JSON Data
- https://api.test.osv.dev/v1/vulns/SUSE-SU-2026:23116-1
- Upstream
- Related
- Published
- 2026-08-03T21:09:28Z
- Modified
- 2026-08-14T18:23:51Z
- Summary
- Security update for php-composer2
- Details
-
This update for php-composer2 fixes the following issues:
- CVE-2026-45793: Github Actions issued
GITHUB_TOKENdisclosure in GitHub Actions logs (bsc#1271504). - CVE-2026-59946: path traversal in package
binfield lets dependencieschmodarbitrary host files (bsc#1271151). - CVE-2026-59947: URL-embedded HTTP-Basic username leaks to verbose logs (bsc#1271129).
- CVE-2026-59948: arbitrary file write outside
vendordirectory via malicious transitive package name (bsc#1271122).
Changes for php-composer2:
- fix byte-swapped signature on s390x can cause broken or unsupported signature (bsc#1271729).
- CVE-2026-45793: Github Actions issued
- References
-
- https://www.suse.com/support/update/announcement/2026/suse-su-202623116-1/
- https://bugzilla.suse.com/1271122
- https://bugzilla.suse.com/1271129
- https://bugzilla.suse.com/1271151
- https://bugzilla.suse.com/1271504
- https://bugzilla.suse.com/1271729
- https://www.suse.com/security/cve/CVE-2025-67746
- https://www.suse.com/security/cve/CVE-2026-40176
- https://www.suse.com/security/cve/CVE-2026-40261
- https://www.suse.com/security/cve/CVE-2026-45793
- https://www.suse.com/security/cve/CVE-2026-59946
- https://www.suse.com/security/cve/CVE-2026-59947
- https://www.suse.com/security/cve/CVE-2026-59948
Affected packages
SUSE:Linux Enterprise Server 16.0 / php-composer2
Package
- Name
- php-composer2
- Purl
- pkg:rpm/suse/php-composer2&distro=SUSE%20Linux%20Enterprise%20Server%2016.0