CVE-2022-24828: Fedoraproject Fedora

High severity, CVSS 8.8. EPSS: 1.9% chance of exploitation in the next 30 days.

Composer is a dependency manager for the PHP programming language. Integrators using Composer code to call `VcsDriver::getFileContent` can have a code injection vulnerability if the user can control the `$file` or `$identifier` argument. This leads to a vulnerability on packagist.org for example where the composer.json's `readme` field can be used as a vector for injecting parameters into hg/Mercurial via the `$file` argument, or git via the `$identifier` argument if you allow arbitrary data there (Packagist does not, but maybe other integrators do). Composer itself should not be affected by the vulnerability as it does not call `getFileContent` with arbitrary data into `$file`/`$identifier`. To the best of our knowledge this was not abused, and the vulnerability has been patched on packagist.org and Private Packagist within a day of the vulnerability report.

Affected products

• Fedoraproject Fedora: version 34 only; version 35 only; version 36 only
• Getcomposer Composer: before 1.10.26 (fixed in 1.10.26); from 2.0.0, before 2.2.12 (fixed in 2.2.12); from 2.3.0, before 2.3.5 (fixed in 2.3.5)
• Tenable Tenable.sc: before 5.21.0 (fixed in 5.21.0)

Published 2022-04-13. Last modified 2026-06-17.