What is CVE-2026-40176?

CVE-2026-40176 is a high-severity vulnerability in Composer, classified under Improper Input Validation. CVSS score: 7.8/10. Published 2026-04-15.

How severe is CVE-2026-40176?

High severity. CVSS v3 base score is 7.8 out of 10.

Is CVE-2026-40176 known to be exploited?

3 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.

RCE in Composer

CVE-2026-40176

Composer is a dependency manager for PHP. Versions 1.0 through 2.2.26 and 2.3 through 2.9.5 contain a command injection vulnerability in the Perforce::generateP4Command() method, which constructs shell commands by interpolating user-supplied Perforce connection parameters (port, user, client) without proper escaping. An attacker can inject arbitrary commands through these values in a malicious composer.json declaring a Perforce VCS repository, leading to command execution in the context of the user running Composer, even if Perforce is not installed. VCS repositories are only loaded from the root composer.json or the composer config directory, so this cannot be exploited through composer.json files of packages installed as dependencies. Users are at risk if they run Composer commands on untrusted projects with attacker-supplied composer.json files. This issue has been fixed in Composer 2.2.27 (2.2 LTS) and 2.9.6 (mainline).

Vulnerability class: Drupalgeddon 2 (CVE-2018-7600)

Published 2026-04-15 · last modified 2026-07-15.

CVSS v3 metric

CVSS v3 base score 7.8 (High). Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H.

EPSS exploit prediction

EPSS: 0.010 (61.3th percentile), scored 2026-09-29.

Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 61st percentile — 61.3% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.

EPSS over last 30 days · oldest: 0.011 · newest: 0.010 · change: -0.001

Affected products

Composer — versions >= 2.3, < 2.9.6, >= 1.0, < 2.2.27
Getcomposer Composer

Weakness classification (CWE)

Public proof-of-concept exploits

References

Frequently asked questions

What is CVE-2026-40176?: CVE-2026-40176 is a high-severity vulnerability in Composer, classified under Improper Input Validation. CVSS score: 7.8/10. Published 2026-04-15.
How severe is CVE-2026-40176?: High severity. CVSS v3 base score is 7.8 out of 10.
Is CVE-2026-40176 known to be exploited?: 3 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.