AIKIDO-2026-430331

TL;DR

Composer registers each package's declared binaries as runnable commands under vendor/bin and adjusts their file permissions during install. It resolves the declared bin path without fully preventing symlinks and path traversal from escaping the package directory, bypassing an earlier fix that only rejected literal parent-directory segments. A malicious package can point a binary at a file outside its own directory, causing Composer to change that file's permissions and register it as a runnable command, which can expose file contents on shared hosting. The fix validates package bin paths against traversal and symlink escape so binaries stay within the package directory.