CVE-2022-24828

Composer is a dependency manager for the PHP programming language. Integrators using Composer code to call `VcsDriver::getFileContent` can have a code injection vulnerability if the user can control the `$file` or `$identifier` argument. This leads to a vulnerability on packagist.org for example where the composer.json's `readme` field can be used as a vector for injecting parameters into hg/Mercurial via the `$file` argument, or git via the `$identifier` argument if you allow arbitrary data there (Packagist does not, but maybe other integrators do). Composer itself should not be affected by the vulnerability as it does not call `getFileContent` with arbitrary data into `$file`/`$identifier`. To the best of our knowledge this was not abused, and the vulnerability has been patched on packagist.org and Private Packagist within a day of the vulnerability report.

• CWE-20
• CWE-88

• https://github.com/composer/composer/commit/2c40c53637c5c7e43fff7c09d3d324d632734709Patch, Third Party Advisory
• https://github.com/composer/composer/security/advisories/GHSA-x7cr-6qr6-2hh6Third Party Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/625MT3IKWKFVIWLSYZFSXHVUA2LES7YQ/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GWT6LDSRY7SFMTDZWJ4MS2ZBXHL7VQEF/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QD7JQWL6C4GVROO25DTXWYWM6BPOPPCG/
• https://www.tenable.com/security/tns-2022-09Patch, Third Party Advisory
• https://github.com/composer/composer/commit/2c40c53637c5c7e43fff7c09d3d324d632734709Patch, Third Party Advisory
• https://github.com/composer/composer/security/advisories/GHSA-x7cr-6qr6-2hh6Third Party Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/625MT3IKWKFVIWLSYZFSXHVUA2LES7YQ/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GWT6LDSRY7SFMTDZWJ4MS2ZBXHL7VQEF/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QD7JQWL6C4GVROO25DTXWYWM6BPOPPCG/
• https://www.tenable.com/security/tns-2022-09Patch, Third Party Advisory

Published

Apr 13, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-24822Podium is a library for building micro frontends. @podium/la…7.5
• CVE-2022-24823Netty is an open-source, asynchronous event-driven network a…5.5
• CVE-2022-24824Discourse is an open source platform for community discussio…5.3
• CVE-2022-24825Smokescreen is a simple HTTP proxy that fogs over naughty UR…5.3
• CVE-2022-24826On Windows, if Git LFS operates on a malicious repository wi…7.8
• CVE-2022-24827Elide is a Java library that lets you stand up a GraphQL/JSO…8.1
• CVE-2022-24829Garden is an automation platform for Kubernetes development …9.8
• CVE-2022-2483 The bootloader in the Nokia ASIK AirScale system module (ve…7.1
• CVE-2022-24830OpenClinica is an open source software for Electronic Data C…9.8
• CVE-2022-24831OpenClinica is an open source software for Electronic Data C…9.8
• CVE-2022-24832GoCD is an open source a continuous delivery server. The bun…6.8
• CVE-2022-24833PrivateBin is minimalist, open source online pastebin clone …6.1