[MEDIUM] Composer: Path traversal in package bin field lets dependencies chmod arbitrary host files

PKSA-q3ht-3g42-rg8f CVE-2026-59946 GHSA-gjfg-22fp-rrxx

Affected package: composer/composer

Affected version: >=1.0.0,<2.2.29|>=2.3.0,<2.10.2

Reported by:
GitHub