Flysystem: WhitespacePathNormalizer's control-character (CorruptedPathDetected) check is bypassed by malformed UTF-8 in the path, affecting every adapter
Low · CVSS 3.5
## Related public issue (context, not a duplicate) Closed issue #1429 ("Handle non-UTF-8 paths", 2024-03-24) raised exactly this general concern and even suggested detection via `preg_match('//u', $path) !== 1` -- note the reporter's suggested check explicitly compares `!== 1`, which *would* correctly treat PCRE's `false` return as "reject." The maintainer's reply pointed to the `PathNormalizer` interface as the place to implement this.
Remediation
Upgrade league/flysystem to 3.35.3 or later.
Affected PHP branches
{'branch': '8.4', 'fixed_in': '8.4.27', 'status': 'patched release available'}
Source: GitHub Global Security Advisories (Composer ecosystem) · retrieved 2026-10-22T10:19:14-04:00 · https://github.com/advisories/GHSA-cxf4-7mrp-vvpr