CVE-2026-102601
1 advisory.
Packagist/league/flysystem CVE-2026-102601: low 3.5, EPSS 0.34%
Flysystem: WhitespacePathNormalizer's control-character (CorruptedPathDetected) check is bypassed by malformed UTF-8 in the path, affecting every adapter
Action: Upgrade league/flysystem to 3.35.3 or later.
composer require league/flysystem:3.35.3Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 3.35.3 | - |
Fixed versions
| 3.35.3 |
Sources
- osv: GHSA-cxf4-7mrp-vvpr
- https://github.com/thephpleague/flysystem/security/advisories/GHSA-cxf4-7mrp-vvpr
- https://nvd.nist.gov/vuln/detail/CVE-2026-102601
- https://github.com/thephpleague/flysystem/commit/ef4a9a557d769b5d472c403125716706a0d9cc77
- https://github.com/thephpleague/flysystem
- https://github.com/thephpleague/flysystem/releases/tag/3.35.3
CVE-2026-102601 · published · modified · JSON