Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
3.5
CVE-2026-102601: Flysystem library can hide malicious filenames
CVE-2026-102601 · published 20 days ago
Summary
The PHP Flysystem file‑storage library before version 3.35.3 could be tricked into accepting specially crafted file names that contain broken UTF‑8 characters. These names can contain hidden control codes, letting attackers create files that appear normal or disguise other data when administrators list directory contents. Upgrade Flysystem to version 3.35.3 or later to stop this behavior.
What to do
- Update league flysystem to version 3.35.3.
- Update league league/flysystem to version 3.35.3.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| – | thephpleague | flysystem | < 3.35.3 |
| composer | league | flysystem |
<= 3.35.2 Fix: upgrade to 3.35.3
|
| Packagist | league | league/flysystem |
< 3.35.3 Fix: upgrade to 3.35.3
|
| Ubuntu:16.04:LTS | canonical | php-league-flysystem | All versions |
| Debian:12 | debian | php-league-flysystem | All versions |
Original advisory text
Flysystem: WhitespacePathNormalizer's control-character (CorruptedPathDetected) check is bypassed by malformed UTF-8 in the path, affecting every adapter
Flysystem is an open source file storage library for PHP. Prior to 3.35.3, the default WhitespacePathNormalizer in src/WhitespacePathNormalizer.php used by Filesystem across adapters calls preg_match with the u modifier and treats both false and 0 as falsy. A path containing malformed UTF-8 causes PCRE to return false, so paths that also contain control characters bypass CorruptedPathDetected::forPath() in normalizePath(). Filesystem::write() can store such names and Filesystem::listContents() can return the raw ANSI escape sequences, allowing hidden or spoofed terminal file listings when an administrator displays them. This issue is fixed in version 3.35.3.
References
- https://github.com/thephpleague/flysystem/commit/ef4a9a557d769b5d472c40312571670... Third Party Advisory
- https://github.com/thephpleague/flysystem/releases/tag/3.35.3 Third Party Advisory
- https://github.com/thephpleague/flysystem/security/advisories/GHSA-cxf4-7mrp-vvp... Third Party Advisory
- https://github.com/advisories/GHSA-cxf4-7mrp-vvpr
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/102xxx/CVE-2026-1026... Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-102601
- https://github.com/thephpleague/flysystem Product
- https://ubuntu.com/security/CVE-2026-102601 Third Party Advisory
- https://www.cve.org/CVERecord?id=CVE-2026-102601 Third Party Advisory
- https://security-tracker.debian.org/tracker/CVE-2026-102601 Vendor Advisory
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker partial control
Type
CWE-150Improper Neutralization of Escape, Meta, or Control Sequences
Timeline
Published29 Sep 2026
Updated19 Oct 2026
First seen29 Sep 2026
Sources
CVE-2026-102601 · NVD
CVE-2026-102601 · MITRE
GHSA-cxf4-7mrp-vvpr · GHSA
CVE-2026-102601 · OSV
GHSA-cxf4-7mrp-vvpr · OSV
UBUNTU-CVE-2026-102601 · OSV
DEBIAN-CVE-2026-102601 · OSV
Track software like this
Free during beta