GHSA-9f46-5r25-5wfm

    Dashboard / Vulnerabilities / GHSA-9f46-5r25-5wfm

    GHSA-9f46-5r25-5wfm

    Published: 29 Jun 2021Last Modified: 8 Jul 2026

    Summary: Time-of-check Time-of-use (TOCTOU) Race Condition in league/flysystem

    Details: ### Impact The whitespace normalisation using in 1.x and 2.x removes any unicode whitespace. Under certain specific conditions this could potentially allow a malicious user to execute code remotely. The conditions: - A user is allowed to supply the path or filename of an uploaded file. - The supplied path or filename is not checked against unicode chars. - The supplied pathname checked against an extension deny-list, not an allow-list. - The supplied path or filename contains a unicode whitespace char in the extension. - The uploaded file is stored in a directory that allows PHP code to be executed. Given these conditions are met a user can upload and execute arbitrary code on the system under attack. ### Patches The unicode whitespace removal has been replaced with a rejection (exception). The library has been patched in: - 1.x: https://github.com/thephpleague/flysystem/commit/f3ad69181b8afed2c9edf7be5a2918144ff4ea32 - 2.x: https://github.com/thephpleague/flysystem/commit/a3c694de9f7e844b76f9d1b61296ebf6e8d89d74 ### Workarounds For 1.x users, upgrade to 1.1.4. For 2.x users, upgrade to 2.1.1.

    References: https://github.com/thephpleague/flysystem/security/advisories/GHSA-9f46-5r25-5wfm, https://nvd.nist.gov/vuln/detail/CVE-2021-32708, https://github.com/thephpleague/flysystem/commit/a3c694de9f7e844b76f9d1b61296ebf6e8d89d74, https://github.com/thephpleague/flysystem/commit/f3ad69181b8afed2c9edf7be5a2918144ff4ea32, https://github.com/FriendsOfPHP/security-advisories/blob/master/league/flysystem/CVE-2021-32708.yaml, https://github.com/thephpleague/flysystem, https://lists.fedoraproject.org/archives/list/[email protected]/message/NWPTENBYKI2IG47GI4DHAACLNRLTWUR5, https://lists.fedoraproject.org/archives/list/[email protected]/message/RNZSWK4GOMJOOHKLZEOE5AQSLC4DNCRZ, https://packagist.org/packages/league/flysystem

    Affected packages

    Package

    Name: league/flysystem

    Purl: pkg:composer/league/flysystem

    Affected ranges

    Type: ECOSYSTEM

    Events:

    Introduced- 0
    Fixed -1.1.4

    Affected versions

    0.1.0
    0.1.1
    0.1.10
    0.1.11
    0.1.12
    0.1.13
    0.1.14
    0.1.15
    0.1.16
    0.1.17
    0.1.18
    0.1.19
    0.1.2
    0.1.20
    0.1.3
    0.1.4
    0.1.5
    0.1.6
    0.1.7
    0.1.8
    0.1.9

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    GHSA-9f46-5r25-5wfm | CVE-DB