SUSE-SU-2026:3105-1

CVE-2026-45793: Github Actions issued GITHUB_TOKEN disclosure in GitHub Actions logs (bsc#1271504).
CVE-2026-59946: path traversal in package bin field lets dependencies chmod arbitrary host files (bsc#1271151).
CVE-2026-59947: URL-embedded HTTP-Basic username leaks to verbose logs (bsc#1271129).
CVE-2026-59948: arbitrary file write outside vendordirectory via malicious transitive package name (bsc#1271122).

References

Affected packages

SUSE:Linux Enterprise Module for Web and Scripting 15 SP7

php-composer2

Name: php-composer2
Purl: pkg:rpm/suse/php-composer2&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Web%20and%20Scripting%2015%20SP7

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

2.6.4-150600.3.12.1

{
    "binaries":  [
        {
            "php-composer2":  "2.6.4-150600.3.12.1"
        }
    ]
}

source

"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:3105-1.json"

SUSE:Linux Enterprise Server 15 SP6-LTSS

php-composer2

Name: php-composer2
Purl: pkg:rpm/suse/php-composer2&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP6-LTSS

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

2.6.4-150600.3.12.1

{
    "binaries":  [
        {
            "php-composer2":  "2.6.4-150600.3.12.1"
        }
    ]
}

source

"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:3105-1.json"

SUSE:Linux Enterprise Server for SAP Applications 15 SP6

php-composer2

Name: php-composer2
Purl: pkg:rpm/suse/php-composer2&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2015%20SP6

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

2.6.4-150600.3.12.1

{
    "binaries":  [
        {
            "php-composer2":  "2.6.4-150600.3.12.1"
        }
    ]
}

source

"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:3105-1.json"