[pkg-php-pear] Bug#1149886: php-league-flysystem: CVE-2026-102601

[Salvatore Bonaccorso]

Source: php-league-flysystem
Version: 3.29.1-2
X-Debbugs-CC: team at security.debian.org
Severity: important
Tags: security upstream

Hi,

The following vulnerability was published for php-league-flysystem.

CVE-2026-102601[0]:
| Flysystem is an open source file storage library for PHP. Prior to
| 3.35.3, the default WhitespacePathNormalizer in
| src/WhitespacePathNormalizer.php used by Filesystem across adapters
| calls preg_match with the u modifier and treats both false and 0 as
| falsy. A path containing malformed UTF-8 causes PCRE to return
| false, so paths that also contain control characters bypass
| CorruptedPathDetected::forPath() in normalizePath().
| Filesystem::write() can store such names and
| Filesystem::listContents() can return the raw ANSI escape sequences,
| allowing hidden or spoofed terminal file listings when an
| administrator displays them. This issue is fixed in version 3.35.3.


If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2026-102601
    https://www.cve.org/CVERecord?id=CVE-2026-102601
[1] https://github.com/thephpleague/flysystem/security/advisories/GHSA-cxf4-7mrp-vvpr
[2] https://github.com/thephpleague/flysystem/commit/ef4a9a557d769b5d472c403125716706a0d9cc77

Please adjust the affected versions in the BTS as needed.

Regards,
Salvatore