{
  "cveId": "CVE-2022-24828",
  "url": "https://patchblox.com/security/cve/CVE-2022-24828",
  "summary": "CVE-2022-24828 is fixed in composer on 1 platform, first by DEBIAN-CVE-2022-24828, released April 13, 2022. It is not reported as exploited. Patch Radar priority: High.",
  "title": "composer: Composer is a dependency manager for the PHP programming language",
  "description": "Composer is a dependency manager for the PHP programming language. Integrators using Composer code to call \u0060VcsDriver::getFileContent\u0060 can have a code injection vulnerability if the user can control the \u0060$file\u0060 or \u0060$identifier\u0060 argument. This leads to a vulnerability on packagist.org for example where the composer.json\u0027s \u0060readme\u0060 field can be used as a vector for injecting parameters into hg/Mercurial via the \u0060$file\u0060 argument, or git via the \u0060$identifier\u0060 argument if you allow arbitrary data there (Packagist does not, but maybe other integrators do). Composer itself should not be affected by the vulnerability as it does not call \u0060getFileContent\u0060 with arbitrary data into \u0060$file\u0060/\u0060$identifier\u0060. To the best of our knowledge this was not abused, and the vulnerability has been patched on packagist.org and Private Packagist within a day of the vulnerability report.",
  "published": "2022-04-13T14:15:00Z",
  "severity": "high",
  "cvss": 8.8,
  "cvssVector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
  "epss": 0.01886,
  "epssPercentile": 0.79637,
  "priority": "High",
  "priorityTier": 3,
  "exploited": false,
  "vendorExploited": false,
  "disclosed": false,
  "fixes": [
    {
      "platform": "linux",
      "product": "composer",
      "release": "Debian 12.15 (bookworm)",
      "fixedVersion": "2.2.12-1",
      "fix": "DEBIAN-CVE-2022-24828",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2022-24828",
      "released": "2022-04-13T21:15:07Z"
    },
    {
      "platform": "linux",
      "product": "composer",
      "release": "Debian 13.5 (trixie)",
      "fixedVersion": "2.2.12-1",
      "fix": "DEBIAN-CVE-2022-24828",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2022-24828",
      "released": "2022-04-13T21:15:07Z"
    },
    {
      "platform": "linux",
      "product": "composer",
      "release": "Debian 14",
      "fixedVersion": "2.2.12-1",
      "fix": "DEBIAN-CVE-2022-24828",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2022-24828",
      "released": "2022-04-13T21:15:07Z"
    },
    {
      "platform": "linux",
      "product": "composer",
      "release": "Ubuntu 18.04.6 LTS (bionic)",
      "fixedVersion": "1.6.3-1ubuntu0.1~esm2",
      "fix": "composer 1.6.3-1ubuntu0.1~esm2",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-bionic-composer-1.6.3-1ubuntu0.1-esm2",
      "released": "2024-06-10T15:15:00Z"
    },
    {
      "platform": "linux",
      "product": "composer",
      "release": "Ubuntu 20.04 LTS (focal)",
      "fixedVersion": "1.10.1-1ubuntu0.1~esm2",
      "fix": "composer 1.10.1-1ubuntu0.1~esm2",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-focal-composer-1.10.1-1ubuntu0.1-esm2",
      "released": "2024-06-10T15:15:00Z"
    },
    {
      "platform": "linux",
      "product": "composer",
      "release": "Ubuntu 22.04.1 LTS (jammy)",
      "fixedVersion": "2.2.6-2ubuntu4\u002Besm1",
      "fix": "composer 2.2.6-2ubuntu4\u002Besm1",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-jammy-composer-2.2.6-2ubuntu4-esm1",
      "released": "2024-06-10T15:15:00Z"
    }
  ],
  "noFixYet": [],
  "dataAsOf": "2026-11-08T06:59:42Z",
  "attribution": {
    "text": "Data: Patchblox Patch Radar",
    "url": "https://patchblox.com/security/patch-radar",
    "terms": "https://patchblox.com/security/patch-radar/use-the-data"
  }
}