debian/php-league-flysystem vulnerabilities

Latest debian/php-league-flysystem CVEs

Newest publication first

1. CVE-2026-102601 Flysystem: WhitespacePathNormalizer's control-character (CorruptedPathDetected) check is bypassed by malformed UTF-8 in the path, affecting every adapter

   Published 2026-09-29

   Low·CVSS 3.5 EPSS 0.34%

   Flysystem is an open source file storage library for PHP. Prior to 3.35.3, the default WhitespacePathNormalizer in src/WhitespacePathNormalizer.php used by Filesystem across adapters calls preg_match with the u modifier and treats both false and 0 as falsy. A path containing malf...

2. CVE-2021-32708 Time-of-check Time-of-use (TOCTOU) Race Condition in league/flysystem

   Published 2021-06-24

   High·CVSS 8.1 EPSS 3.5% PoC

   Flysystem is an open source file storage library for PHP. The whitespace normalisation using in 1.x and 2.x removes any unicode whitespace. Under certain specific conditions this could potentially allow a malicious user to execute code remotely. The conditions are: A user is allo...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.