Security readout for executives and security teams
Plain-English summary
This is a critical file-upload risk in PHP applications using vulnerable Flysystem versions. If several unsafe upload conditions align, a crafted filename can bypass extension blocking and allow uploaded PHP code to run. The source bundle does not show active exploitation.
Executive priority
Prioritize remediation where Flysystem supports public or partner upload features. The CVSS is critical, but business urgency depends on whether unsafe upload handling and executable storage directories exist in your environment.
Technical view
CVE-2021-32708 affects league/flysystem before 1.1.4 and 2.0.0 through before 2.1.1. Unicode whitespace normalization removed characters from paths or filenames, creating a TOCTOU-style extension handling issue when applications relied on deny-lists and executable upload directories.
Likely exposure
Exposure is most likely in PHP applications using Flysystem for user-controlled uploads, especially where users influence filenames or paths, extension deny-lists are used, Unicode characters are not rejected, and uploaded files reside where PHP execution is allowed.
Exploitation context
The advisory describes remote code execution only under specific combined conditions. KEV is false in the provided bundle, and no cited source states known active exploitation. Treat internet-facing upload workflows as the highest-priority review target.
Researcher notes
The vulnerability hinges on application context, not merely package presence. Confirm the vulnerable version, filename control, Unicode handling, deny-list logic, and web server execution behavior before declaring exploitable exposure. The fixed releases replaced whitespace normalization with rejection by exception.
Mitigation direction
- Upgrade Flysystem 1.x deployments to 1.1.4 or later.
- Upgrade Flysystem 2.x deployments to 2.1.1 or later.
- Reject Unicode whitespace in user-supplied upload paths and filenames.
- Use extension allow-lists instead of deny-lists for uploads.
- Disable PHP execution in directories receiving uploaded files.
- Check vendor and distribution guidance for packaged deployments.
Validation and detection
- Inventory applications and lockfiles for league/flysystem versions.
- Review upload paths where users control filenames or directories.
- Confirm upload validation rejects Unicode whitespace characters.
- Verify upload handling uses an allow-list, not only a deny-list.
- Confirm uploaded files cannot execute as PHP.
- Prioritize internet-facing and unauthenticated upload workflows.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-367: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupExecution behavior lookup
The CVE wording references code or command execution, so execution technique review may help defensive triage. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupCVE-2021-32708 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Critical
- CVSS
- 9.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H3.95.9Primary CVE scoreVulnerability scoring details
Base CVSS 3.1 score
9.8CriticalVector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Source materials
- CVE List V5 sourceCVE List V5
- https://github.com/thephpleague/flysystem/security/advisories/GHSA-9f46-5r25-5wfmCVE reference · x_refsource_CONFIRM
- https://github.com/thephpleague/flysystem/commit/a3c694de9f7e844b76f9d1b61296ebf6e8d89d74CVE reference · x_refsource_MISC
- https://github.com/thephpleague/flysystem/commit/f3ad69181b8afed2c9edf7be5a2918144ff4ea32CVE reference · x_refsource_MISC
- https://packagist.org/packages/league/flysystemCVE reference · x_refsource_MISC
- FEDORA-2021-717516a2e9CVE reference · vendor-advisory, x_refsource_FEDORA
- FEDORA-2021-b9187c535cCVE reference · vendor-advisory, x_refsource_FEDORA
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Time-of-check Time-of-use (TOCTOU) Race Condition
Time-of-check Time-of-use (TOCTOU) Race Condition represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.