Alerts This Week
Warning Icon 1 640
Alerts This Week
Warning Icon 1 640

openSUSE php-composer2 Important Command Injection Vuln 2026-1970-1

opensuse
Calendar Grey May 18, 2026
Dist Opensuse Esm H88
An important update for openSUSE php-composer2 addresses command injection vulnerabilities to enhance security.
An update that solves eight vulnerabilities can now be installed.

Description

This update for php-composer2 fixes the following issues

* CVE-2026-40176: command injection via malicious Perforce repository

definition (bsc#1262254).

* CVE-2026-40261: command injection via malicious Perforce source

reference/url (bsc#1262255).

Changes for php-composer2:

* version update to 2.2.27 (align with upstream LTS version)

* Security: Hardened git/hg/perforce/fossil identifier validation to ensure

branch names starting with - do not cause issues (246f807b, 246f807b,

246f807b)

* Security: Fixed Perforce unescaped user input in queryP4User shell command

(246f807b)

* Security: Fixed usage of insecure 3DES ciphers when ext-curl is missing

(21ffece62)

* Fixed issue handling paths with = in them on Windows (#11568)

* version 2.2.26 2025-12-30

* Security: Fixed ANSI sequence injection (GHSA-59pp-r3rg-353g /

CVE-2025-67746)

* version 2.2.25 2024-12-11

* Fixed deprecation notices appearing on this LTS version in case it is used

...

Read the Full Advisory

Topics%20covered

Topics Covered

security advisory vulnerability important threat mitigation command injection OpenSUSE php-composer2

Patch

## Patch Instructions:

To install this SUSE update use the SUSE recommended installation methods like

YaST online_update or "zypper patch".

Alternatively you can run the command listed for your product:

* openSUSE Leap 15.4

zypper in -t patch SUSE-2026-1970=1

* SUSE Linux Enterprise High Performance Computing ESPOS 15 SP4

zypper in -t patch SUSE-SLE-Product-HPC-15-SP4-ESPOS-2026-1970=1

* SUSE Linux Enterprise High Performance Computing LTSS 15 SP4

zypper in -t patch SUSE-SLE-Product-HPC-15-SP4-LTSS-2026-1970=1

* SUSE Linux Enterprise High Performance Computing ESPOS 15 SP5

zypper in -t patch SUSE-SLE-Product-HPC-15-SP5-ESPOS-2026-1970=1

* SUSE Linux Enterprise High Performance Computing LTSS 15 SP5

zypper in -t patch SUSE-SLE-Product-HPC-15-SP5-LTSS-2026-1970=1

* SUSE Linux Enterprise Server 15 SP4 LTSS

zypper in -t patch SUSE-SLE-Product-SLES-15-SP4-LTSS-2026-1970=1

* SUSE Linux Enterprise Server 15 SP5 LTSS

zypper in -t patch SUSE-SLE-Product-SLES-15-SP5-LTSS-2026-1970=1

* SUSE Linux Enterprise...

Read the Full Advisory

Package List

* openSUSE Leap 15.4 (noarch)

* php-composer2-2.2.27-150400.3.18.1

* SUSE Linux Enterprise High Performance Computing ESPOS 15 SP4 (noarch)

* php-composer2-2.2.27-150400.3.18.1

* SUSE Linux Enterprise High Performance Computing LTSS 15 SP4 (noarch)

* php-composer2-2.2.27-150400.3.18.1

* SUSE Linux Enterprise High Performance Computing ESPOS 15 SP5 (noarch)

* php-composer2-2.2.27-150400.3.18.1

* SUSE Linux Enterprise High Performance Computing LTSS 15 SP5 (noarch)

* php-composer2-2.2.27-150400.3.18.1

* SUSE Linux Enterprise Server 15 SP4 LTSS (noarch)

* php-composer2-2.2.27-150400.3.18.1

* SUSE Linux Enterprise Server 15 SP5 LTSS (noarch)

* php-composer2-2.2.27-150400.3.18.1

* SUSE Linux Enterprise Server for SAP Applications 15 SP4 (noarch)

* php-composer2-2.2.27-150400.3.18.1

* SUSE Linux Enterprise Server for SAP Applications 15 SP5 (noarch)

* php-composer2-2.2.27-150400.3.18.1

References

* bsc#1262254

* bsc#1262255

## References:

* https://www.suse.com/security/cve/CVE-2022-24828.html

* https://www.suse.com/security/cve/CVE-2023-43655.html

* https://www.suse.com/security/cve/CVE-2024-24821.html

* https://www.suse.com/security/cve/CVE-2024-35241.html

* https://www.suse.com/security/cve/CVE-2024-35242.html

* https://www.suse.com/security/cve/CVE-2025-67746.html

* https://www.suse.com/security/cve/CVE-2026-40176.html

* https://www.suse.com/security/cve/CVE-2026-40261.html

* https://bugzilla.suse.com/show_bug.cgi?id=1262254

* https://bugzilla.suse.com/show_bug.cgi?id=1262255

Severity
important
Lowest
Low
Medium
High
Critical

Announcement ID: SUSE-SU-2026:1970-1
Release Date: 2026-05-18T08:16:20Z
Affected Products: * openSUSE Leap 15.4 * SUSE Linux Enterprise High Performance Computing 15 SP4 * SUSE Linux Enterprise High Performance Computing 15 SP5 * SUSE Linux Enterprise High Performance Computing ESPOS 15 SP4 * SUSE Linux Enterprise High Performance Computing ESPOS 15 SP5 * SUSE Linux Enterprise High Performance Computing LTSS 15 SP4 * SUSE Linux Enterprise High Performance Computing LTSS 15 SP5 * SUSE Linux Enterprise Server 15 SP4 * SUSE Linux Enterprise Server 15 SP4 LTSS * SUSE Linux Enterprise Server 15 SP5 * SUSE Linux Enterprise Server 15 SP5 LTSS * SUSE Linux Enterprise Server for SAP Applications 15 SP4 * SUSE Linux Enterprise Server for SAP Applications 15 SP5

Topics%20covered

Topics Covered

security advisory vulnerability important threat mitigation command injection OpenSUSE php-composer2

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.

Your message here