Source: php-league-flysystem Version: 3.29.1-2 X-Debbugs-CC: [email protected] Severity: important Tags: security upstream
Hi, The following vulnerability was published for php-league-flysystem. CVE-2026-102601[0]: | Flysystem is an open source file storage library for PHP. Prior to | 3.35.3, the default WhitespacePathNormalizer in | src/WhitespacePathNormalizer.php used by Filesystem across adapters | calls preg_match with the u modifier and treats both false and 0 as | falsy. A path containing malformed UTF-8 causes PCRE to return | false, so paths that also contain control characters bypass | CorruptedPathDetected::forPath() in normalizePath(). | Filesystem::write() can store such names and | Filesystem::listContents() can return the raw ANSI escape sequences, | allowing hidden or spoofed terminal file listings when an | administrator displays them. This issue is fixed in version 3.35.3. If you fix the vulnerability please also make sure to include the CVE (Common Vulnerabilities & Exposures) id in your changelog entry. For further information see: [0] https://security-tracker.debian.org/tracker/CVE-2026-102601 https://www.cve.org/CVERecord?id=CVE-2026-102601 [1] https://github.com/thephpleague/flysystem/security/advisories/GHSA-cxf4-7mrp-vvpr [2] https://github.com/thephpleague/flysystem/commit/ef4a9a557d769b5d472c403125716706a0d9cc77 Please adjust the affected versions in the BTS as needed. Regards, Salvatore
