8.8

CVE-2023-43655: composer Injection

CVSS: 8.8v3.1HighAnalyzed
AliasesSUSE-SU-2023:4041-1UBUNTU-CVE-2023-43655DEBIAN-CVE-2023-43655
Published 29-09-2023Last modified 18-06-2025
Open JSON

Vulnerability summary

CVE-2023-43655 is a high (CVSS 8.8) Injection vulnerability in composer. EPSS estimates a 1.53% chance of exploitation in the next 30 days, higher than 74.4% of scored vulnerabilities.

Overall risk
36/100
0100
Medium · default modelHow is this calculated?
CVSS score
8.8/10
010
High · v3.1 (NVD)
EPSS score
1.53%
0%100%
Low · +0.14 pp in 30 days
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 1 · Related 1
USN-7603-1

Timeline

  1. 29-09-2023
    PublishedVulnerability first disclosed.
  2. 18-06-2025
    Last modifiedVulnerability information updated.

Description

Composer is a dependency manager for PHP. Users publishing a composer.phar to a public web-accessible server where the composer.phar can be executed as a php file may be subject to a remote code execution vulnerability if PHP also has `register_argc_argv` enabled in php.ini. Versions 2.6.4, 2.2.22 and 1.10.27 patch this vulnerability. Users are advised to upgrade. Users unable to upgrade should make sure `register_argc_argv` is disabled in php.ini, and avoid publishing composer.phar to the web as this is not best practice.

CVSS metrics

4 scores · 4 sources · 1 version

EPSS trend

Probability

1.53%

Chance of exploitation in the next 30 days

Percentile

74%

Versus all other CVEs

30-day change

+0.14 pp

From 1.39% on 19-09-2026

19-09-202619-10-2026
EPSS score
1.53%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

Affected systems

Opensuse3 products
  • php-composer2&distro=openSUSE Leap 15.4< 2.2.3-150400.3.6.1
  • php-composer2&distro=openSUSE Leap 15.5< 2.2.3-150400.3.6.1
  • php-composer2&distro=openSUSE Tumbleweed< 2.6.4-1.1
Debian2 products
  • composer< 2.5.5-1+deb12u4 | < 2.6.4-1 | < 1.8.4-1+deb10u3
  • debian_linuxEOL10.0
Suse2 products
  • php-composer2&distro=SUSE Linux Enterprise Module for Web and Scripting 15 SP4< 2.2.3-150400.3.6.1
  • php-composer2&distro=SUSE Linux Enterprise Module for Web and Scripting 15 SP5< 2.2.3-150400.3.6.1
Composer1 product
  • composer2.6.4, 2.2.21, 1.10.27 | ≥ 2.0, < 2.2.22 | < 1.10.27
Fedoraproject1 product
Getcomposer1 product
  • composer< 1.10.27 | ≥ 2.0.0, < 2.2.21 | ≥ 2.3.0, < 2.6.4
Ubuntu1 product
  • composer< 1.0.0~beta2-1ubuntu0.1~esm2 | < 1.6.3-1ubuntu0.1~esm2 | < 1.10.1-1ubuntu0.1~esm2 | < 2.2.6-2ubuntu4+esm1

7 vendors · 11 products

References

15 links
Show all 15 references