Summary

Private Packagist Cloud blocks user supplied URLs, such as mirrored third-party repository URLs, that point to private network addresses. URLs with a bracketed IPv6 address as host were not recognized by this filter.

Who was affected

Private Packagist Cloud until the fix on June 4, 2026. Private Packagist Self-Hosted does not block private network addresses, because Self-Hosted installations are expected to access servers in their own network, and was not affected.

Impact

A malicious user able to configure a mirrored third-party repository on Private Packagist Cloud could have used a URL with a bracketed IPv6 address to make Private Packagist Cloud send requests to internal network addresses that its private network filter is meant to block, and so reach internal services that are not meant to be reachable from outside.

What we did

The private network filter of Private Packagist Cloud now also recognizes bracketed IPv6 addresses.

Do customers need to do anything

• Private Packagist Cloud: No action is required.

Credits

Thanks to Soman verma for reporting this issue.

All security advisories