league/flysystem

Security advisories for league/flysystem, newest first. 2 known, 1 without a fix yet.

RSS feed Check your lock file →

Latest version

3.36.0

Advisories

2 · 1 unfixed

Last advisory

29 Sep 2026

Safe from

no fix for all yet

2 advisories · newest first

LOW3.5 29 Sep 2026

Flysystem: WhitespacePathNormalizer's control-character (CorruptedPathDetected) check is bypassed by malformed UTF-8 in the path, affecting every adapter

GHSA-cxf4-7mrp-vvpr · CVE-2026-102601

Affected

≤ 3.35.2

Fixed in

no fix yet

Published

29 Sep 2026

CRITICAL9.8 23 Jun 2021

TOCTOU Race Condition enabling remote code execution

GHSA-9f46-5r25-5wfm · CVE-2021-32708

Affected

< 1.1.4 ≥ 2.0.0, < 2.1.1

Fixed in

1.1.4 2.1.1

Published

23 Jun 2021

/advisories/composer/league/flysystem/feed.rss

From Packagist and the GitHub advisory database · synced hourly

Same vendor

league/commonmark18 advisories

Know when your sites are affected.

Porro reads composer.lock and package-lock from every site on your care plans and puts the ones that need you at the top. Updates arrive as pull requests.

Start your free trial →