Your message dated Sun, 25 Oct 2026 10:49:36 +0000
with message-id <[email protected]>
and subject line Bug#1149886: fixed in php-league-flysystem 3.36.0-1
has caused the Debian Bug report #1149886,
regarding php-league-flysystem: CVE-2026-102601
to be marked as done.
This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.
(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact [email protected]
immediately.)
--
1149886: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1149886
Debian Bug Tracking System
Contact [email protected] with problems
--- Begin Message ---
Source: php-league-flysystem
Version: 3.29.1-2
X-Debbugs-CC: [email protected]
Severity: important
Tags: security upstream
Hi,
The following vulnerability was published for php-league-flysystem.
CVE-2026-102601[0]:
| Flysystem is an open source file storage library for PHP. Prior to
| 3.35.3, the default WhitespacePathNormalizer in
| src/WhitespacePathNormalizer.php used by Filesystem across adapters
| calls preg_match with the u modifier and treats both false and 0 as
| falsy. A path containing malformed UTF-8 causes PCRE to return
| false, so paths that also contain control characters bypass
| CorruptedPathDetected::forPath() in normalizePath().
| Filesystem::write() can store such names and
| Filesystem::listContents() can return the raw ANSI escape sequences,
| allowing hidden or spoofed terminal file listings when an
| administrator displays them. This issue is fixed in version 3.35.3.
If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.
For further information see:
[0] https://security-tracker.debian.org/tracker/CVE-2026-102601
https://www.cve.org/CVERecord?id=CVE-2026-102601
[1]
https://github.com/thephpleague/flysystem/security/advisories/GHSA-cxf4-7mrp-vvpr
[2]
https://github.com/thephpleague/flysystem/commit/ef4a9a557d769b5d472c403125716706a0d9cc77
Please adjust the affected versions in the BTS as needed.
Regards,
Salvatore
--- End Message ---
--- Begin Message ---
Source: php-league-flysystem
Source-Version: 3.36.0-1
Done: David Prévot <[email protected]>
We believe that the bug you reported is fixed in the latest version of
php-league-flysystem, which is due to be installed in the Debian FTP archive.
A summary of the changes between this version and the previous one is
attached.
Thank you for reporting the bug, which will now be closed. If you
have further comments please address them to [email protected],
and the maintainer will reopen the bug report if appropriate.
Debian distribution maintenance software
pp.
David Prévot <[email protected]> (supplier of updated php-league-flysystem
package)
(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing [email protected])
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
Format: 1.8
Date: Sun, 25 Oct 2026 10:56:13 +0100
Source: php-league-flysystem
Architecture: source
Version: 3.36.0-1
Distribution: unstable
Urgency: medium
Maintainer: Debian PHP PEAR Maintainers <[email protected]>
Changed-By: David Prévot <[email protected]>
Closes: 1149886
Changes:
php-league-flysystem (3.36.0-1) unstable; urgency=medium
.
* New upstream version 3.36.0
+ Report broken utf-8 as a corrupted path [CVE-2026-102601]
(Closes: #1149886)
* Remove redundant Priority: optional from source stanza
* Update standards version to 4.7.4
* Update watch file format version to 5
* Removed Rules-Requires-Root
* Use debhelper-compat 14
* Add self to Uploaders
* Update copyright (years)
* Document lintian-overrides
Checksums-Sha1:
b0a9e0c9e7bfc12291b1bdce6e73ecb473026845 2308 php-league-flysystem_3.36.0-1.dsc
f1bb47afcf127d21f20fd9e6fbecb75f5b000a9b 94536
php-league-flysystem_3.36.0.orig.tar.xz
6982d8eaed10b718f19c159427fe3c85a1ba8f58 21456
php-league-flysystem_3.36.0-1.debian.tar.xz
67b60bd8f51acff911f22f9e55d7292988254554 7810
php-league-flysystem_3.36.0-1_amd64.buildinfo
Checksums-Sha256:
7543d0370e46361539b34b278b2a0ece06734ccbef1b8a8d0bd89ba46dfebb4f 2308
php-league-flysystem_3.36.0-1.dsc
9c72724d28fe41579b95888e538f76bb672c5af454421f0dec402f7198949d50 94536
php-league-flysystem_3.36.0.orig.tar.xz
1c83153c1c5d0894d7081dac3a51e78f5e0a01b90bfd1f6a5845a0e60ced11d1 21456
php-league-flysystem_3.36.0-1.debian.tar.xz
f6cb21b5bfe84edd94975bd659363967a8ba7fc58494132d6adace1da12c8249 7810
php-league-flysystem_3.36.0-1_amd64.buildinfo
Files:
1cd7826ce28b39040758e4b503b8cba4 2308 php optional
php-league-flysystem_3.36.0-1.dsc
85b0a3da520989fb9041272d15169469 94536 php optional
php-league-flysystem_3.36.0.orig.tar.xz
920f94b02412830d656939c411020769 21456 php optional
php-league-flysystem_3.36.0-1.debian.tar.xz
82285110b84a97dab17ded8222eddd38 7810 php optional
php-league-flysystem_3.36.0-1_amd64.buildinfo
-----BEGIN PGP SIGNATURE-----
iQIzBAEBCgAdFiEErhStAUJtK/uC734euCohev3+CfIFAmrd16wACgkQuCohev3+
CfKyqA//VZ/gxA31hLAOlhiYbO4JN+TgW2pXP2B86SfDn8ckWiM3qMF/P71HYb7l
VqGZlxZ148+Vzy+h56jAlBhRNW6xrtrLaN7BRKI4twB9/Izt1F1MrM5WWS/3eFF0
1JEjSXRVKtWHdwqD7OB5pizsVY4qspq0DyZl2wv7Rvoi87JbDWe2Ngr0zMyYvkl0
Tyxcl9JaGXlvkjSftTT+VHOGaJHKDruSBmvLXWLL+D9xRQtdDTubaBzP9AsfPq4m
1zyJ1k0LD5e80M+QAbgQ9v05oyMY/grsd9S7WXRsTGF3YdPpEaHJ+cTdIZpyewGo
5o/SNOMlwVG/KnTAwaS1bRbUCEZfewhxstTUI9w8R5CHmHgpotHBciEDxur0K9f9
hUIkFPoVX+NNFwgMLis6CvMHdx9weNuv/mV0WYaU1lhbUFDX5UihpXmTbFMAv3Kn
m3zQ3uPjgYJSTOUOB5zPXIOq5U1pExaIHtLSYV9ueyaxW2w4Gjfm+3fHHA8t2/cF
E3Y0482tTY4RBGooQVrNsn2+oSBFkzTKsH8aGN37yEGbDSVwc0zSGeHQTIbvhs40
F6BfWnombMgOCIvqehfhB2ffMG4wU/6A5o1dKJPdS3zreMCksp/qpjqdDkwNZKLp
hVxNQFoUQG7NdRGsf4jD9tOHgE/sT+TVq0K66LbpaZtEG21PDS0=
=gdbh
-----END PGP SIGNATURE-----
pgpqWlnVKIbrH.pgp
Description: PGP signature
--- End Message ---
