The vulnerability of the normalizePath() function in the src/WhitespacePathNormalizer.php file of the Flysystem library, which allows a attacker to compromise the integrity of the protected information.

The vulnerability of the normalizePath function in the src/WhitespacePathNormalizer.php file of the Flysystem library is related to the failure to take measures to eliminate special elements. Exploiting this vulnerability could allow a remote attacker to compromise the integrity of the protected...

CLSA-2026-1790868478 TuxCare security update for league/flysystem (1 CVE)

TuxCare rebuilt league/flysystem to address 1 CVE. Fixed in 3.33.0-p1+tuxcare...

Linux Distros Unpatched Vulnerability : CVE-2026-102601

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Flysystem is an open source file storage library for PHP. Prior to 3.35.3, the default WhitespacePathNormalizer in src/WhitespacePathNormalizer.php used by...

GHSA-CXF4-7MRP-VVPR Flysystem: WhitespacePathNormalizer's control-character (CorruptedPathDetected) check is bypassed by malformed UTF-8 in the path, affecting every adapter

Related public issue context, not a duplicate Closed issue 1429 "Handle non-UTF-8 paths", 2024-03-24 raised exactly this general concern and even suggested detection via pregmatch'//u', $path !== 1 -- note the reporter's suggested check explicitly compares !== 1, which would correctly treat PCRE'...

Flysystem: WhitespacePathNormalizer's control-character (CorruptedPathDetected) check is bypassed by malformed UTF-8 in the path, affecting every adapter

Related public issue context, not a duplicate Closed issue 1429 "Handle non-UTF-8 paths", 2024-03-24 raised exactly this general concern and even suggested detection via pregmatch'//u', $path !== 1 -- note the reporter's suggested check explicitly compares !== 1, which would correctly treat PCRE'...

CVE-2026-102601

Flysystem is an open source file storage library for PHP. Prior to 3.35.3, the default WhitespacePathNormalizer in src/WhitespacePathNormalizer.php used by Filesystem across adapters calls pregmatch with the u modifier and treats both false and 0 as falsy. A path containing malformed UTF-8 causes...

DEBIAN-CVE-2026-102601

Flysystem is an open source file storage library for PHP. Prior to 3.35.3, the default WhitespacePathNormalizer in src/WhitespacePathNormalizer.php used by Filesystem across adapters calls pregmatch with the u modifier and treats both false and 0 as falsy. A path containing malformed UTF-8 causes...

UBUNTU-CVE-2026-102601

Flysystem is an open source file storage library for PHP. Prior to 3.35.3, the default WhitespacePathNormalizer in src/WhitespacePathNormalizer.php used by Filesystem across adapters calls pregmatch with the u modifier and treats both false and 0 as falsy. A path containing malformed UTF-8 causes...

CVE-2026-102601

Flysystem is an open source file storage library for PHP. Prior to 3.35.3, the default WhitespacePathNormalizer in src/WhitespacePathNormalizer.php used by Filesystem across adapters calls pregmatch with the u modifier and treats both false and 0 as falsy. A path containing malformed UTF-8 causes...

CVE-2026-102601 Flysystem: WhitespacePathNormalizer's control-character (CorruptedPathDetected) check is bypassed by malformed UTF-8 in the path, affecting every adapter

Flysystem is an open source file storage library for PHP. Prior to 3.35.3, the default WhitespacePathNormalizer in src/WhitespacePathNormalizer.php used by Filesystem across adapters calls pregmatch with the u modifier and treats both false and 0 as falsy. A path containing malformed UTF-8 causes...

CVE-2026-102601

Flysystem is an open source file storage library for PHP. Prior to 3.35.3, the default WhitespacePathNormalizer in src/WhitespacePathNormalizer.php used by Filesystem across adapters calls pregmatch with the u modifier and treats both false and 0 as falsy. A path containing malformed UTF-8 causes...

CVE-2026-102601 Flysystem: WhitespacePathNormalizer's control-character (CorruptedPathDetected) check is bypassed by malformed UTF-8 in the path, affecting every adapter

Flysystem is an open source file storage library for PHP. Prior to 3.35.3, the default WhitespacePathNormalizer in src/WhitespacePathNormalizer.php used by Filesystem across adapters calls pregmatch with the u modifier and treats both false and 0 as falsy. A path containing malformed UTF-8 causes...

EUVD-2026-88998

Flysystem is an open source file storage library for PHP. Prior to 3.35.3, the default WhitespacePathNormalizer in src/WhitespacePathNormalizer.php used by Filesystem across adapters calls pregmatch with the u modifier and treats both false and 0 as falsy. A path containing malformed UTF-8 causes...

CVE-2026-102601

The Flysystem PHP file storage library is vulnerable in versions prior to 3.35.3 due to a flaw in the WhitespacePathNormalizer component. The root cause is that preg_match with the u modifier treats false (returned during malformed UTF-8 input) as falsy, allowing paths containing control characte...

CVE-2026-102601 Flysystem: WhitespacePathNormalizer's control-character (CorruptedPathDetected) check is bypassed by malformed UTF-8 in the path, affecting every adapter

Flysystem is an open source file storage library for PHP. Prior to 3.35.3, the default WhitespacePathNormalizer in src/WhitespacePathNormalizer.php used by Filesystem across adapters calls pregmatch with the u modifier and treats both false and 0 as falsy. A path containing malformed UTF-8 causes...

CVE-2026-102601: Improper Neutralization of Escape, Meta, or Control Sequences

Flysystem is an open source file storage library for PHP. Prior to 3.35.3, the default WhitespacePathNormalizer in src/WhitespacePathNormalizer.php used by Filesystem across adapters calls pregmatch with the u modifier and treats both false and 0 as falsy. A path containing malformed UTF-8 causes...

PT-2026-102644

Name of the Vulnerable Software and Affected Versions Flysystem versions prior to 3.35.3 Description In the WhitespacePathNormalizer class within src/WhitespacePathNormalizer.php, the normalizePath function uses preg match with the u modifier to detect control characters. When a path contains...

EUVD-2026-69706

Laravel Excel writes exports outside the configured filesystem disk when given a caller-controlled path...

CVE-2026-84374 Laravel Excel writes exports outside the configured filesystem disk when given a caller-controlled path

Laravel Excel provides supercharged Excel exports and imports in Laravel. From 3.1.8 until 3.1.70, in src/Files/Disk.php the Maatwebsite\Excel\Files\Disk::copy method resolves the caller-controlled $destination supplied through Excel::store, $export-store, or storeExcel against the process workin...

CVE-2026-84374 Laravel Excel writes exports outside the configured filesystem disk when given a caller-controlled path

Laravel Excel provides supercharged Excel exports and imports in Laravel. From 3.1.8 until 3.1.70, in src/Files/Disk.php the Maatwebsite\Excel\Files\Disk::copy method resolves the caller-controlled $destination supplied through Excel::store, $export-store, or storeExcel against the process workin...