CVE-2023-43655

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

Composer is a dependency manager for PHP. Users publishing a composer.phar to a public web-accessible server where the composer.phar can be executed as a php file may be subject to a remote code execution vulnerability if PHP also has `register_argc_argv` enabled in php.ini. Versions 2.6.4, 2.2.22 and 1.10.27 patch this vulnerability. Users are advised to upgrade. Users unable to upgrade should make sure `register_argc_argv` is disabled in php.ini, and avoid publishing composer.phar to the web as this is not best practice.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-74

Affected software

VendorProductVersions
composercomposer2.6.4, 2.2.21, 1.10.27; >= 2.0, < 2.2.22; < 1.10.27
dockercomposer<= 2.6.4

References

Timeline

Published
Sep 29, 2023
Last modified
Jun 17, 2026
NVD status
Analyzed

Related CVEs from 2023

CVE-2023-436569.0matrix-hookshot is a Matrix bot for connecting to external services like GitHub, GitLab, JIRA, and more. Instances that have enabled transfoCVE-2023-436576.1discourse-encrypt is a plugin that provides a secure communication channel through Discourse. Improper escaping of encrypted topic titles coCVE-2023-436586.1dicourse-calendar is a plugin for the Discourse messaging platform which adds the ability to create a dynamic calendar in the first post of CVE-2023-436595.4Discourse is an open source platform for community discussion. Improper escaping of user input allowed for Cross-site Scripting attacks via CVE-2023-43668.8Use after free in Extensions in Google Chrome prior to 116.0.5845.96 allowed an attacker who convinced a user to install a malicious extensiCVE-2023-436608.1Warpgate is a smart SSH, HTTPS and MySQL bastion host for Linux that doesn't need special client apps. The SSH key verification for a user cCVE-2023-436618.8Cachet is an open-source status page system. Prior to the 2.4 branch, a template functionality which allows users to create templates allowsCVE-2023-436628.6ShokoServer is a media server which specializes in organizing anime. In affected versions the `/api/Image/WithPath` endpoint is accessible wCVE-2023-436634.3PrestaShop is an Open Source e-commerce web application. In affected versions any module can be disabled or uninstalled from back office, evCVE-2023-436644.3PrestaShop is an Open Source e-commerce web application. In the Prestashop Back office interface, an employee can list all modules without aCVE-2023-436657.5In Django 3.2 before 3.2.22, 4.1 before 4.1.12, and 4.2 before 4.2.6, the django.utils.text.Truncator chars() and words() methods (when usedCVE-2023-436666.5Insufficient Verification of Data Authenticity vulnerability in Apache InLong.This issue affects Apache InLong: from 1.4.0 through 1.8.0, 
CVE-2023-43655: High severity, CVSS 8.8 | Vulnix