league/flysystem vulnerabilities (Packagist)

2 vulnerabilities.

• league/flysystem Packagist Flysystem: WhitespacePathNormalizer's control-character (CorruptedPathDetected) check is bypassed by malformed UTF-8 in the path, affecting every adapter CVE-2026-102601 Fix available 3.5 LowSeptember 29, 2026
• league/flysystem Packagist Time-of-check Time-of-use (TOCTOU) Race Condition in league/flysystem CVE-2021-32708 Public exploitFix available 9.8 CriticalJune 24, 2021