GHSA-w6hj-6587-3jh5: 
PHP 취약점 분석 및 완화

Summary

A malicious package archive could cause Composer to write a file outside the intended package directory during composer install, composer update, or composer require. Because the written file can be an application entry point or another file that later gets executed, this can lead to code execution. It is arbitrary file write, not a flaw triggered by normal Packagist-hosted packages, which do not carry the kind of archive entries required.

Am I affected?

You are affected if all of the following hold:

• You run Composer 1.0.0 through 2.11.1.
• You install packages whose distribution archive (zip) an attacker can control. In practice this means untrusted third-party Composer repositories, private or self-hosted repositories, artifact mirrors, or any attacker-controlled dist URL.
• Your system has the unzip command available (standard on Linux and macOS) together with the PHP zip extension. When those hold, a crafted archive can redirect one of its entries so the content lands outside the package directory, for example overwriting a front controller in the project root, which yields code execution on the next request or command. You are plainly not affected if every package you install comes from a trusted source. Packagist.org-hosted archives generally do not contain the archive entries this relies on, so typical Packagist.org-only installs are not a realistic vector. The single most realistic way to get hit: adding or updating a package served by an untrusted or attacker-controlled repository or mirror.

Patched versions

Fixed in 2.11.2 and 2.2.32.

Workarounds

The only complete fix is upgrading.