File exposure via escaping dependency binary paths

Path traversal in Composer's binary installer allows attackers to expose external files via malicious dependency binaries. BinaryInstaller and FileDownloader follow escaping binary symlinks or paths from vendor/composer/installed.json without checking resolved-path containment, changing target permissions and registering vendor/bin proxies. Exploitation requires processing a malicious dependency and a target modifiable by the Composer process; the metadata route additionally requires a reused or lower-trust vendor directory, and the flaw neither directly transmits data nor independently provides remote code execution.