---
title: "CVE-2026-40261\n    | Ubuntu"
description: Ubuntu is an open source software operating system that runs from the
  desktop, to the cloud, to all your internet connected things.
url: https://ubuntu.com/security/CVE-2026-40261?format=md
keywords: index, follow
---

# CVE-2026-40261

Publication date 15 April 2026

Last updated 13 May 2026

---

Ubuntu priority

**Medium**

[Why this priority?](https://ubuntu.com/security/cves/about#priority )

## Cvss 3 Severity Score

**8.8 · High**

[Score breakdown](https://ubuntu.com/security/CVE-2026-40261?format=md#impact-score)

Toggle side navigation

## Description

Composer is a dependency manager for PHP. Versions 1.0 through 2.2.26 and
2.3 through 2.9.5 contain a command injection vulnerability in the
Perforce::syncCodeBase() method, which appends the $sourceReference
parameter to a shell command without proper escaping, and additionally in
the Perforce::generateP4Command() method as in GHSA-wg36-wvj6-r67p /
CVE-2026-40176, which interpolates user-supplied Perforce connection
parameters (port, user, client) from the source url field without proper
escaping. An attacker can inject arbitrary commands through crafted source
reference or source url values containing shell metacharacters, even if
Perforce is not installed. Unlike CVE-2026-40176, the source reference and
url are provided as part of package metadata, meaning any compromised or
malicious Composer repository can serve package metadata declaring perforce
as a source type with malicious values. This vulnerability is exploitable
when installing or updating dependencies from source, including the default
behavior when installing dev-prefixed versions. This issue has been fixed
in Composer 2.2.27 (2.2 LTS) and 2.9.6 (mainline). If developers are unable
to immediately update, they can avoid installing dependencies from source
by using --prefer-dist or the preferred-install: dist config setting, and
only use trusted Composer repositories as a workaround.

## Status

Show unmaintained releases

| Package | Ubuntu Release | Status |
| --- | --- | --- |
| composer | 26.04 LTS resolute | Needs evaluation |
| 25.10 questing | Ignored end of life, was needs-triage |
| 24.04 LTS noble | Needs evaluation |
| 22.04 LTS jammy | Needs evaluation |
| 20.04 LTS focal | Needs evaluation |
| 18.04 LTS bionic | Needs evaluation |
| 16.04 LTS xenial | Needs evaluation |

---

* [How can I get the fixes?](https://ubuntu.com/security/cves/about#security)
* [What do statuses mean?](https://ubuntu.com/security/cves/about#statuses)

## Severity score breakdown

CVSS version:
CVSS v3.0

**Base score**

8.8 · High

* Base metrics

  | Parameter | Value |
  | --- | --- |
  | Attack vector | Network |
  | Attack complexity | Low |
  | Privileges required | None |
  | User interaction | Required |
  | Scope | Unchanged |
  | Confidentiality impact | High |
  | Integrity impact | High |
  | Availability impact | High |
* Scores

  | Parameter | Value |
  | --- | --- |
  | Base score | 8.8 · High |
  | Exploitability score | - |
  | Impact score | - |

**Vector:** CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

## References

* [MITRE](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-40261)
* [NVD](https://nvd.nist.gov/vuln/detail/CVE-2026-40261)
* [Launchpad](https://launchpad.net/bugs/cve/CVE-2026-40261)
* [Debian](https://security-tracker.debian.org/tracker/CVE-2026-40261)

### Other references

* <https://www.cve.org/CVERecord?id=CVE-2026-40261>
* <https://github.com/composer/composer/security/advisories/GHSA-gqw4-4w2p-838q>