fkie_cve-2026-102601

Flysystem is an open source file storage library for PHP. Prior to 3.35.3, the default WhitespacePathNormalizer in src/WhitespacePathNormalizer.php used by Filesystem across adapters calls preg_match with the u modifier and treats both false and 0 as falsy. A path containing malformed UTF-8 causes PCRE to return false, so paths that also contain control characters bypass CorruptedPathDetected::forPath() in normalizePath(). Filesystem::write() can store such names and Filesystem::listContents() can return the raw ANSI escape sequences, allowing hidden or spoofed terminal file listings when an administrator displays them. This issue is fixed in version 3.35.3.

GHSA-cxf4-7mrp-vvpr — Flysystem: WhitespacePathNormalizer's control-character (CorruptedPathDetected) check is bypassed by malformed UTF-8 in…

Affected: Packagist: league/flysystem

## Related public issue (context, not a duplicate)

Closed issue #1429 ("Handle non-UTF-8 paths", 2024-03-24) raised exactly this general concern and even suggested detection via `preg_match('//u', $path) !== 1` -- note the reporter's suggested check explicitly compares `!== 1`, which *would* correctly treat PCRE's `false` return as "reject." The maintainer's reply pointed to the `PathNormalizer` interface as the place to implement this. The control-character check that ended up shipping in `WhitespacePathNormalizer` (`if (preg_match('#\p{C}+#u', $unixPath))`) addresses the general concern but does **not** use the `!== 1`-style comparison the original issue suggested -- it uses a bare truthy check, which is exactly the gap this report demonstrates. So this is not a duplicate of #1429; it's a concrete bypass surviving in the fix that issue's concern led to.

## Vulnerability Details

**File**: `src/WhitespacePathNormalizer.php`, lines 22-28 (`normalizePath()`) -- the **default** `PathNormalizer` used by `Filesystem` for every adapter (Local, FTP, SFTP, S3, AsyncAwsS3, Azure, GCS, ZipArchive, GridFS, InMemory) unless the application supplies a custom one.

### Root Cause

```php public function normalizePath(string $path): string { $unixPath = str_replace('\\', '/', $path);

if (preg_match('#\p{C}+#u', $unixPath)) { throw CorruptedPathDetected::forPath($path); } ... ```

`preg_match()` returns `false` (a PHP engine error) rather than `0` when the subjec…

Most recent entries from all

fkie_cve-2026-102601

GHSA-cxf4-7mrp-vvpr — Flysystem: WhitespacePathNormalizer's control-character (CorruptedPathDetected) check is bypassed by malformed UTF-8 in…