Los paquetes de Composer en CISA KEV (y los dos que son dependencias de desarrollo)
1,500 paquetes de Composer tienen avisos publicados. Solo 24 CVE repartidos entre ellos están en CISA KEV, y se concentran en núcleos de CMS: Drupal, Craft, Magento, October. Para los equipos de Laravel, los tres que importan son Ignition, Livewire y un antiguo RCE del framework.
1,528paquetes con avisos
8,599avisos
24CVE en CISA KEV
17paquetes a los que afectan
Dónde cae KEV en el ecosistema de Composer
1,528 paquetes de 656 proveedores tienen al menos un aviso (OSV.dev + FriendsOfPHP). 24 CVE están en CISA KEV, afectando a 17 nombres de paquete — y la mayoría de ellos son núcleos de CMS, porque un RCE no autenticado en un CMS merece automatizarse a escala de internet.
Las 30 entradas KEV completas
| Paquete | CVE | Qué | Severidad | EPSS | Corregido en |
|---|---|---|---|---|---|
| phpunit/phpunit | CVE-2017-9841 KEV | Code Injection in PHPUnit | critical 9.8 | 100% | 4.8.28, 5.6.3 |
| magento/community-edition | CVE-2024-34102 KEV | Magento Open Source affected by an Improper Restriction of XML External Entity Reference ('XXE') vul | critical 9.8 | 100% | — |
| magento/product-community-edition | CVE-2024-34102 KEV | Arbitrary Code Execution through Improper Restriction of XML External Entity Reference (XXE) vulnera | unknown 0.0 | 100% | 2.4.4, 2.4.4-p9, 2.4.5-p8 |
| drupal/core | CVE-2018-7600 KEV | A remote code execution vulnerability exists within multiple subsystems of Drupal 7.x and 8.x. This | critical 9.8 | 100% | 8.3.9, 8.4.6, 8.5.1 |
| drupal/drupal | CVE-2018-7600 KEV | Drupal Core Remote Code Execution Vulnerability | critical 9.8 | 100% | 7.58, 8.3.9, 8.4.6 |
| facade/ignition | CVE-2021-3129 KEV | Unauthenticated remote code execution via insecure file handling in debug mode | critical 9.8 | 100% | 2.5.2, 1.16.14 |
| craftcms/cms | CVE-2025-32432 KEV | Craft CMS Allows Remote Code Execution | critical 10.0 | 100% | 3.9.15, 4.14.15, 5.6.17 |
| phpmailer/phpmailer | CVE-2016-10033 KEV | Remote code execution via crafted Sender in the isMail transport | critical 9.8 | 100% | 5.2.20 |
| roundcube/roundcubemail | CVE-2025-49113 KEV | Roundcube Webmail Vulnerable to Authenticated RCE via PHP Object Deserialization | critical 9.9 | 100% | 1.5.10, 1.6.11 |
| magento/community-edition | CVE-2022-24086 KEV | Magento improper input validation vulnerability | critical 9.8 | 99% | 2.3.7-p3, 2.4.3-p2 |
| drupal/core | CVE-2018-7602 KEV | A remote code execution vulnerability exists within multiple subsystems of Drupal 7.x and 8.x. This | critical 9.8 | 99% | 8.4.8, 8.5.3, 7.59 |
| drupal/drupal | CVE-2018-7602 KEV | Drupal Core Remote Code Execution Vulnerability | critical 9.8 | 99% | 7.59, 8.4.8, 8.5.3 |
| vrana/adminer | CVE-2021-21311 KEV | SSRF in adminer | high 7.2 | 98% | 4.7.9 |
| craftcms/cms | CVE-2024-56145 KEV | Craft CMS has potential RCE when PHP `register_argc_argv` config setting is enabled | critical 9.8 | 97% | 5.5.2, 4.13.2, 3.9.14 |
| livewire/livewire | CVE-2025-54068 KEV | Livewire is vulnerable to remote command execution during component property update hydration | critical 9.8 | 96% | 3.6.4 |
| magento/community-edition | CVE-2025-54236 KEV | Magento Community Edition Improper Input Validation vulnerability | critical 9.1 | 95% | — |
| magento/project-community-edition | CVE-2025-54236 KEV | Magento Community Edition Improper Input Validation vulnerability | critical 9.1 | 95% | — |
| drupal/core | CVE-2019-6340 KEV | Some field types do not properly sanitize data from non-form sources. This can lead to arbitrary PHP | high 8.1 | 92% | 8.5.11, 8.6.10, 7.62.0 |
| drupal/drupal | CVE-2019-6340 KEV | Drupal Core Remote Code Execution Vulnerability | high 8.1 | 92% | 7.62.0, 8.5.11, 8.6.10 |
| october/system | CVE-2021-32648 KEV | Account Takeover in Octobercms | high 8.2 | 90% | 1.0.472, 1.1.5 |
| drupal/core | CVE-2026-9082 KEV | Drupal core includes a database abstraction API to ensure that queries executed against the database | critical 9.8 | 89% | 10.4.10, 10.5.10, 10.6.9 |
| yiisoft/yii2 | CVE-2024-58136 KEV | yiisoft/yii2 Mishandles the Attaching of Behavior Defined by a `__class` Array Key | critical 9.0 | 88% | 2.0.52 |
| components/jquery | CVE-2020-11023 KEV | Potential XSS vulnerability in jQuery | medium 6.9 | 85% | 3.5.0 |
| pear/archive_tar | CVE-2020-28949 KEV | Potential file overwrite if archive filename starts with file:// | unknown 0.0 | 85% | 1.4.11 |
| laravel/framework | CVE-2018-15133 KEV | Laravel Framework RCE Vulnerability | high 8.1 | 77% | 5.6.30 |
| pear/archive_tar | CVE-2020-36193 KEV | Directory Traversal in Archive_Tar | high 7.5 | 71% | 1.4.13 |
| drupal/core | CVE-2020-13671 KEV | *Update November 18: Documented longer list of dangerous file extensions* Drupal core does not prop | high 8.8 | 36% | 8.8.11, 8.9.9, 9.0.8 |
| drupal/drupal | CVE-2020-13671 KEV | Drupal core Unrestricted Upload of File with Dangerous Type | high 8.8 | 36% | 7.74, 8.8.11, 8.9.9 |
| craftcms/cms | CVE-2025-23209 KEV | Craft CMS has a potential RCE with a compromised security key | high 8.0 | 22% | 5.5.8, 4.13.8 |
| craftcms/cms | CVE-2025-35939 KEV | Craft CMS stores arbitrary content provided by unauthenticated users in session files | medium 5.3 | 1% | 5.7.5, 4.15.3 |
Las dos que son dependencias de desarrollo
phpunit/phpunit (CVE-2017-9841, EPSS 100%) and facade/ignition (CVE-2021-3129, EPSS 100%) están entre los CVE de PHP más explotados de internet, y ninguno tiene cabida en un servidor de producción. El eval-stdin.php de PHPUnit y la página de error de depuración de Ignition solo son accesibles cuando se desplegaron paquetes de require-dev. Ejecutar composer install --no-dev --optimize-autoloader en el paso de despliegue elimina toda la clase.
Si usa Laravel
130 avisos afectan a paquetes del ecosistema de Laravel (laravel/*, livewire, filament, spatie, ignition). Tres están en KEV. Clasificados por EPSS:
| Paquete | CVE | Qué | Severidad | EPSS | Corregido en |
|---|---|---|---|---|---|
| facade/ignition | CVE-2021-3129 KEV | Unauthenticated remote code execution via insecure file handling in debug mode | critical 9.8 | 100% | 2.5.2, 1.16.14 |
| livewire/livewire | CVE-2025-54068 KEV | Livewire is vulnerable to remote command execution during component property update hydration | critical 9.8 | 96% | 3.6.4 |
| laravel/framework | CVE-2018-15133 KEV | Laravel Framework RCE Vulnerability | high 8.1 | 77% | 5.6.30 |
| laravel/framework | CVE-2024-52301 | Laravel environment manipulation via query string | high 0.0 | 45% | 6.20.45, 7.30.7, 8.83.28 |
| laravel/pulse | CVE-2024-55661 | Laravel Pulse Allows Remote Code Execution via Unprotected Query Method | high 0.0 | 31% | 1.3.1 |
| laravel/framework | CVE-2021-43617 | Image upload bypass | unknown 0.0 | 20% | 8.71.0 |
| rap2hpoutre/laravel-log-viewer | CVE-2018-8947 | Plaintext Storage of Sensitive Information in Laravel Log Viewer before v0.13.0 | high 7.5 | 11% | 0.13.0 |
| unisharp/laravel-filemanager | CVE-2022-40734 | UniSharp Laravel Filemanager directory traversal vulnerability | medium 6.5 | 5% | 2.6.4 |
Como comparación, Symfony tiene 270 avisos en el feed y ninguno en KEV; 6 superan un EPSS del 10%. El número de avisos dice poco sobre la presión de ataque.
EPSS alto, no en KEV
KEV se cura manualmente y va con retraso. Estos paquetes de Composer tienen CVE con un EPSS ≥ 50% que (todavía) no están catalogados:
| Paquete | CVE | Qué | Severidad | EPSS | Corregido en |
|---|---|---|---|---|---|
| maximebf/debugbar | CVE-2020-11022 | Potential XSS vulnerability in jQuery | medium 6.9 | 99% | 1.19.0 |
| athlon1600/youtube-downloader | CVE-2020-11022 | Potential XSS vulnerability in jQuery | medium 6.9 | 99% | 4.0.1 |
| components/jquery | CVE-2020-11022 | Potential XSS vulnerability in jQuery | medium 6.9 | 99% | 3.5.0 |
| billz/raspap-webgui | CVE-2022-39986 | RaspAP Command Injection vulnerability | critical 9.8 | 99% | 2.8.8 |
| open-web-analytics/open-web-analytics | CVE-2022-24637 | Improper Privilege Management in Open Web Analytics | critical 9.8 | 99% | 1.7.4 |
| phpmyadmin/phpmyadmin | CVE-2018-12613 | phpMyAdmin Improper Authentication | high 8.8 | 98% | 4.8.2 |
| phpmailer/phpmailer | CVE-2016-10045 | Remote code execution in PHPMailer | critical 9.8 | 98% | 5.2.20 |
| froxlor/froxlor | CVE-2023-0315 | Froxlor vulnerable to Command Injection | high 8.8 | 98% | 2.0.8 |
| studio-42/elfinder | CVE-2019-9194 | elFinder command injection vulnerability in the PHP connector | critical 9.8 | 97% | 2.1.48 |
| librenms/librenms | CVE-2022-3562 | Cross-site Scripting in librenms/librenms | medium 5.4 | 94% | 22.10.0 |
| craftcms/cms | CVE-2023-41892 | Craft CMS Remote Code Execution vulnerability | critical 10.0 | 94% | 4.4.15 |
| librenms/librenms | CVE-2022-4067 | Cross-site Scripting in librenms/librenms | medium 5.4 | 94% | 22.10.0 |
Qué hacer
- Despliegue con
--no-dev. Luego confírmelo:phpwarden deps composer.locklista los paquetes de desarrollo si están en el lockfile, y la comprobación de alcanzabilidad le dice si algo de su código referencia un paquete vulnerable. - Condicione el CI a la explotación, no al CVSS.
fail-on: exploiteden la GitHub Action bloquea el merge solo para las entradas KEV; añada un umbral de severidad si quiere más. - Vigile el EPSS, no solo KEV. La segunda tabla de arriba es lo que KEV parecerá dentro de unos meses.
Compruebe su propio proyecto con un solo comando
Cero dependencias, sin conexión, Apache-2.0. Clasifica por KEV → EPSS → CVSS.
composer require --dev phpwarden/phpwarden # PHP projects → vendor/bin/phpwarden
vendor/bin/phpwarden deps composer.lock # Composer
vendor/bin/phpwarden scan # PHP engine on this host
vendor/bin/phpwarden wordpress /var/www/html # WordPress core, plugins, themesEn CI: uses: oroma-alfred/phpwarden-action@v1
con fail-on: exploited. O composer require --dev phpwarden/phpwarden.