CVE-2026-102601 in Flysystem
Summary
by MITRE • 09/29/2026
Flysystem is an open source file storage library for PHP. Prior to 3.35.3, the default WhitespacePathNormalizer in src/WhitespacePathNormalizer.php used by Filesystem across adapters calls preg_match with the u modifier and treats both false and 0 as falsy. A path containing malformed UTF-8 causes PCRE to return false, so paths that also contain control characters bypass CorruptedPathDetected::forPath() in normalizePath(). Filesystem::write() can store such names and Filesystem::listContents() can return the raw ANSI escape sequences, allowing hidden or spoofed terminal file listings when an administrator displays them. This issue is fixed in version 3.35.3.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 09/29/2026
Flysystem serves as a widely adopted open-source PHP library designed to abstract file storage operations across various adapters and cloud services. A critical security vulnerability was identified within the default WhitespacePathNormalizer component, specifically affecting versions prior to 3.35.3. This normalizer is responsible for processing file paths to ensure they conform to expected formatting standards before being passed to underlying filesystem adapters. The core technical flaw lies in how the function handles return values from PHP's PCRE regular expression engine when using the u modifier for UTF-8 validation. Specifically, the implementation treats both false and zero as falsy conditions, which leads to an incorrect assumption about path validity. When a file path contains malformed UTF-8 sequences, the preg_match function returns false rather than zero or one. Due to the flawed conditional logic, this return value is not recognized as an error state, allowing the normalization process to proceed without triggering appropriate security checks.
This logical flaw creates a pathway for control characters and ANSI escape codes to bypass the CorruptedPathDetected exception handling mechanism within the normalizePath method. Normally, such exceptions would prevent invalid or potentially dangerous paths from being processed further in the application lifecycle. However, because malformed UTF-8 sequences cause preg_match to return false, which is then treated as a valid outcome by the faulty logic, these malicious inputs are accepted into the system. Consequently, when developers use Filesystem::write() to store files with such names, the library does not reject them or sanitize the control characters effectively. This results in file entries being created on the storage backend that contain raw ANSI escape sequences embedded within their filenames.
The operational impact of this vulnerability is significant for applications that display directory listings or file contents retrieved via Filesystem::listContents(). When an administrator or user views a listing containing these specially crafted filenames, the terminal emulator interprets the embedded ANSI codes as commands rather than literal text. This can lead to hidden files appearing in directories by manipulating cursor positions and colors, effectively spoofing the visual representation of the filesystem structure. In more severe scenarios, this technique could be used for terminal injection attacks or phishing attempts where malicious actors disguise harmful links or sensitive information within seemingly benign directory listings. The vulnerability essentially undermines the integrity of file system representations presented to end-users, potentially leading to confusion, data exfiltration through disguised paths, or social engineering exploits targeting administrative personnel who rely on these visual cues for decision-making.
From a classification perspective, this issue aligns with CWE-20 Improper Input Validation and CWE-79 Cross-site Scripting if the output is rendered in web contexts that interpret ANSI codes as HTML-like sequences, though primarily it represents an input validation bypass leading to unintended side effects in terminal environments. In terms of MITRE ATT&CK mapping, this vulnerability facilitates techniques related to Defense Evasion through Obfuscated Files or Information and potentially Command and Control via Application Layer Protocol if used for covert communication channels within logs or listings. To mitigate this risk, organizations must upgrade Flysystem to version 3.35.3 or later where the logic has been corrected to properly distinguish between false returns indicating errors and zero returns indicating no match. Additionally, developers should implement strict input validation at application boundaries before passing paths to library functions and consider sanitizing output when displaying file listings in terminal-based interfaces to prevent interpretation of control characters as executable commands. Regular security audits focusing on string handling and regular expression return value checks are recommended to identify similar logical flaws in other components that rely on PCRE behavior assumptions.