CVE-2026-102601
Received Received - Intake

Path Traversal in Flysystem PHP Library

Publication date: 2026-09-29

Last updated on: 2026-09-29

Assigner: GitHub, Inc.

Description
Flysystem is an open source file storage library for PHP. Prior to 3.35.3, the default WhitespacePathNormalizer in src/WhitespacePathNormalizer.php used by Filesystem across adapters calls preg_match with the u modifier and treats both false and 0 as falsy. A path containing malformed UTF-8 causes PCRE to return false, so paths that also contain control characters bypass CorruptedPathDetected::forPath() in normalizePath(). Filesystem::write() can store such names and Filesystem::listContents() can return the raw ANSI escape sequences, allowing hidden or spoofed terminal file listings when an administrator displays them. This issue is fixed in version 3.35.3.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-29
Last Modified
2026-09-29
Generated
2026-09-29
AI Q&A
2026-09-29
EPSS Evaluated
N/A
NVD
CVE-2026-102601
EUVD
EUVD-2026-88998

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
thephpleague flysystem 3.35.3
thephpleague flysystem to 3.35.3 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-150 The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could be interpreted as escape, meta, or control character sequences when they are sent to a downstream component.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in Flysystem, a PHP file storage library, involves a flaw in the WhitespacePathNormalizer class. When processing file paths with malformed UTF-8 characters, the system incorrectly treats invalid paths as valid due to a falsy check on preg_match results. This allows attackers to create filenames with control characters that bypass security checks.

Detection Guidance

Check for files with malformed UTF-8 paths or control characters in filenames. Use commands like 'find /path -type f -name "*[\x80-\xFF]*"' to search for non-ASCII filenames. Inspect filesystem logs for unusual path handling. Verify if your Flysystem version is below 3.35.3.

Impact Analysis

An attacker could exploit this to store malicious filenames containing ANSI escape sequences. When administrators view directory listings, these sequences could manipulate terminal output, hiding files, erasing lines, or spoofing file names to trick users into interacting with malicious content.

Compliance Impact

This vulnerability may impact compliance by allowing unauthorized file manipulation or data exposure through spoofed filenames. GDPR requires data integrity and security, while HIPAA mandates access controls; this flaw could undermine both by enabling unauthorized terminal manipulation and potential data leaks.

Mitigation Strategies

Upgrade Flysystem to version 3.35.3 or later immediately. Review and remove any files with suspicious filenames containing control characters or malformed UTF-8. Implement input validation for file paths in your application to reject invalid UTF-8 sequences.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-102601. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart