Vulnerability · Published Sep 29, 2026 · Assigned by GitHub_M
CVE-2026-102601Flysystem: WhitespacePathNormalizer's control-character (CorruptedPathDetected) check is bypassed by malformed UTF-8 in the path, affecting every adapter
Low 3.5
In plain English
A low-severity security flaw in flysystem from thephpleague. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 27% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
Flysystem is an open source file storage library for PHP. Prior to 3.35.3, the default WhitespacePathNormalizer in src/WhitespacePathNormalizer.php used by Filesystem across adapters calls preg_match with the u modifier and treats both false and 0 as falsy. A path containing malformed UTF-8 causes PCRE to return false, so paths that also contain control characters bypass CorruptedPathDetected::forPath() in normalizePath(). Filesystem::write() can store such names and Filesystem::listContents() can return the raw ANSI escape sequences, allowing hidden or spoofed terminal file listings when an administrator displays them. This issue is fixed in version 3.35.3.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | php-league-flysystem | no fix listed | DEBIAN-CVE-2026-102601 |
| Debian:13 | php-league-flysystem | no fix listed | DEBIAN-CVE-2026-102601 |
| Debian:14 | php-league-flysystem | 3.36.0-1 | DEBIAN-CVE-2026-102601 |
| Packagist | league/flysystem | 3.35.3 | GHSA-cxf4-7mrp-vvpr |
| Ubuntu:22.04:LTS | php-league-flysystem | no fix listed | UBUNTU-CVE-2026-102601 |
| Ubuntu:24.04:LTS | php-league-flysystem | no fix listed | UBUNTU-CVE-2026-102601 |
| Ubuntu:26.04:LTS | php-league-flysystem | no fix listed | UBUNTU-CVE-2026-102601 |
| Ubuntu:26.10 | php-league-flysystem | no fix listed | UBUNTU-CVE-2026-102601 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| thephpleague | flysystem | < 3.35.3 |
Weakness: CWE-150 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N