← Vulnerability feed

Vulnerability record · CVE-2015-8371 · published 21 September 2023

CVE-2015-8371: Getcomposer composer insufficient verification of data authenticity vulnerability

Getcomposer · Composer

Composer before 2016-02-10 allows cache poisoning from other projects built on the same host. This results in attacker-controlled code entering a server-side build process. The issue occurs because of the way that dist packages are cached. The cache key is derived from the package name, the dist type, and certain other data from the package repository (which may simply be a commit hash, and thus can be found by an attacker). Versions through 1.0.0-alpha11 are affected, and 1.0.0 is unaffected.

8.8 CVSS 3.1 High EPSS 0.70% · top 48.9% CWE-345 · Insufficient verification of data authenticity
8.8CVSS 3.1 base score
0.70%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
8References, 2 tagged exploit
17 Jun 2026Last modified by NVD

Description

Composer before 2016-02-10 allows cache poisoning from other projects built on the same host. This results in attacker-controlled code entering a server-side build process. The issue occurs because of the way that dist packages are cached. The cache key is derived from the package name, the dist type, and certain other data from the package repository (which may simply be a commit hash, and thus can be found by an attacker). Versions through 1.0.0-alpha11 are affected, and 1.0.0 is unaffected.

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://flyingmana.de/blog_en/2016/02/14/composer_cache_injection_vulnerability_cve_2015_8371.html ExploitThird Party Advisory
https://github.com/FriendsOfPHP/security-advisories/blob/e26be423c5bcfdb38478d2f92d1f928c15afb561/composer/composer/CVE- Third Party Advisory
https://github.com/composer/composer Product
https://gitlab.com/gitlab-org/advisories-community/-/blob/main/packagist/composer/composer/CVE-2015-8371.yml Third Party Advisory
https://flyingmana.de/blog_en/2016/02/14/composer_cache_injection_vulnerability_cve_2015_8371.html ExploitThird Party Advisory
https://github.com/FriendsOfPHP/security-advisories/blob/e26be423c5bcfdb38478d2f92d1f928c15afb561/composer/composer/CVE- Third Party Advisory
https://github.com/composer/composer Product
https://gitlab.com/gitlab-org/advisories-community/-/blob/main/packagist/composer/composer/CVE-2015-8371.yml Third Party Advisory

Track CVE-2015-8371 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.8CVE-2021-41116Getcomposer composer command injection vulnerabilityComposer is an open source dependency manager for the PHP language. In affected versions windows users running Composer to install untrusted dependen…EPSS 2.9%8.8CVE-2026-40261Getcomposer composer improper input validation vulnerabilityComposer is a dependency manager for PHP. Versions 1.0 through 2.2.26 and 2.3 through 2.9.5 contain a command injection vulnerability in the Perforce…EPSS 1.9%8.8CVE-2023-43655Getcomposer composer injection vulnerabilityComposer is a dependency manager for PHP. Users publishing a composer.phar to a public web-accessible server where the composer.phar can be executed …EPSS 1.4%8.8CVE-2022-24828Getcomposer composer improper input validation vulnerabilityComposer is a dependency manager for the PHP programming language. Integrators using Composer code to call `VcsDriver::getFileContent` can have a cod…EPSS 1.9%8.8CVE-2021-29472Getcomposer composer argument injection vulnerabilityComposer is a dependency manager for PHP. URLs for Mercurial repositories in the root composer.json and package source download URLs are not sanitize…EPSS 4.6%7.8CVE-2026-40176Getcomposer composer improper input validation vulnerabilityComposer is a dependency manager for PHP. Versions 1.0 through 2.2.26 and 2.3 through 2.9.5 contain a command injection vulnerability in the Perforce…EPSS 1.00%7.8CVE-2024-24821Getcomposer composer inclusion from untrusted sphere vulnerabilityComposer is a dependency Manager for the PHP language. In affected versions several files within the local working directory are included during the …EPSS 0.28%1.3CVE-2025-67746Getcomposer composer injection vulnerabilityComposer is a dependency manager for PHP. In versions on the 2.x branch prior to 2.2.26 and 2.9.3, attackers controlling remote sources that Composer…EPSS 0.45%

Source: NIST National Vulnerability Database (record CVE-2015-8371), CISA KEV, FIRST EPSS (scores of 2026-09-27). This page is refreshed as NVD updates the record.