Hi,

The following vulnerability was published for php-league-flysystem.

CVE-2026-102601[0]:
| Flysystem is an open source file storage library for PHP. Prior to
| 3.35.3, the default WhitespacePathNormalizer in
| src/WhitespacePathNormalizer.php used by Filesystem across adapters
| calls preg_match with the u modifier and treats both false and 0 as
| falsy. A path containing malformed UTF-8 causes PCRE to return
| false, so paths that also contain control characters bypass
| CorruptedPathDetected::forPath() in normalizePath().
| Filesystem::write() can store such names and
| Filesystem::listContents() can return the raw ANSI escape sequences,
| allowing hidden or spoofed terminal file listings when an
| administrator displays them. This issue is fixed in version 3.35.3.


If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2026-102601
https://www.cve.org/CVERecord?id=CVE-2026-102601
[1] https://github.com/thephpleague/flysystem/security/advisories/GHSA-cxf4-7mrp-vvpr
[2] https://github.com/thephpleague/flysystem/commit/ef4a9a557d769b5d472c403125716706a0d9cc77

Please adjust the affected versions in the BTS as needed.

Regards,
Salvatore

We believe that the bug you reported is fixed in the latest version of
php-league-flysystem, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 1149886@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
David Prévot <taffit@debian.org> (supplier of updated php-league-flysystem package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)
Format: 1.8
Date: Sun, 25 Oct 2026 10:56:13 +0100
Source: php-league-flysystem
Architecture: source
Version: 3.36.0-1
Distribution: unstable
Urgency: medium
Maintainer: Debian PHP PEAR Maintainers <pkg-php-pear@lists.alioth.debian.org>
Changed-By: David Prévot <taffit@debian.org>
Closes: 1149886
Changes:
 php-league-flysystem (3.36.0-1) unstable; urgency=medium
 .
   * New upstream version 3.36.0
     + Report broken utf-8 as a corrupted path [CVE-2026-102601]
       (Closes: #1149886)
   * Remove redundant Priority: optional from source stanza
   * Update standards version to 4.7.4
   * Update watch file format version to 5
   * Removed Rules-Requires-Root
   * Use debhelper-compat 14
   * Add self to Uploaders
   * Update copyright (years)
   * Document lintian-overrides
Checksums-Sha1:
 b0a9e0c9e7bfc12291b1bdce6e73ecb473026845 2308 php-league-flysystem_3.36.0-1.dsc
 f1bb47afcf127d21f20fd9e6fbecb75f5b000a9b 94536 php-league-flysystem_3.36.0.orig.tar.xz
 6982d8eaed10b718f19c159427fe3c85a1ba8f58 21456 php-league-flysystem_3.36.0-1.debian.tar.xz
 67b60bd8f51acff911f22f9e55d7292988254554 7810 php-league-flysystem_3.36.0-1_amd64.buildinfo
Checksums-Sha256:
 7543d0370e46361539b34b278b2a0ece06734ccbef1b8a8d0bd89ba46dfebb4f 2308 php-league-flysystem_3.36.0-1.dsc
 9c72724d28fe41579b95888e538f76bb672c5af454421f0dec402f7198949d50 94536 php-league-flysystem_3.36.0.orig.tar.xz
 1c83153c1c5d0894d7081dac3a51e78f5e0a01b90bfd1f6a5845a0e60ced11d1 21456 php-league-flysystem_3.36.0-1.debian.tar.xz
 f6cb21b5bfe84edd94975bd659363967a8ba7fc58494132d6adace1da12c8249 7810 php-league-flysystem_3.36.0-1_amd64.buildinfo
Files:
 1cd7826ce28b39040758e4b503b8cba4 2308 php optional php-league-flysystem_3.36.0-1.dsc
 85b0a3da520989fb9041272d15169469 94536 php optional php-league-flysystem_3.36.0.orig.tar.xz
 920f94b02412830d656939c411020769 21456 php optional php-league-flysystem_3.36.0-1.debian.tar.xz
 82285110b84a97dab17ded8222eddd38 7810 php optional php-league-flysystem_3.36.0-1_amd64.buildinfo
-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEErhStAUJtK/uC734euCohev3+CfIFAmrd16wACgkQuCohev3+
CfKyqA//VZ/gxA31hLAOlhiYbO4JN+TgW2pXP2B86SfDn8ckWiM3qMF/P71HYb7l
VqGZlxZ148+Vzy+h56jAlBhRNW6xrtrLaN7BRKI4twB9/Izt1F1MrM5WWS/3eFF0
1JEjSXRVKtWHdwqD7OB5pizsVY4qspq0DyZl2wv7Rvoi87JbDWe2Ngr0zMyYvkl0
Tyxcl9JaGXlvkjSftTT+VHOGaJHKDruSBmvLXWLL+D9xRQtdDTubaBzP9AsfPq4m
1zyJ1k0LD5e80M+QAbgQ9v05oyMY/grsd9S7WXRsTGF3YdPpEaHJ+cTdIZpyewGo
5o/SNOMlwVG/KnTAwaS1bRbUCEZfewhxstTUI9w8R5CHmHgpotHBciEDxur0K9f9
hUIkFPoVX+NNFwgMLis6CvMHdx9weNuv/mV0WYaU1lhbUFDX5UihpXmTbFMAv3Kn
m3zQ3uPjgYJSTOUOB5zPXIOq5U1pExaIHtLSYV9ueyaxW2w4Gjfm+3fHHA8t2/cF
E3Y0482tTY4RBGooQVrNsn2+oSBFkzTKsH8aGN37yEGbDSVwc0zSGeHQTIbvhs40
F6BfWnombMgOCIvqehfhB2ffMG4wU/6A5o1dKJPdS3zreMCksp/qpjqdDkwNZKLp
hVxNQFoUQG7NdRGsf4jD9tOHgE/sT+TVq0K66LbpaZtEG21PDS0=
=gdbh
-----END PGP SIGNATURE-----