PHP security digest · Packages

league/flysystem security advisories

1 advisory we have followed since September 2026, newest first. Each page says who is affected, which versions fix it and how to check your project.

Low 29 Sep 2026

Flysystem: WhitespacePathNormalizer's control-character (CorruptedPathDetected) check is bypassed by malformed UTF-8 in the path, affecting every adapter

Fixed in 3.35.3 · CVE-2026-102601

Check your project in one command

Composer compares your composer.lock with the public advisory databases:

composer audit

It lists every installed package with a known advisory, including league/flysystem, and the version that fixes it.