PHP League Flysystem up to 3.35.2 WhitespacePathNormalizer WhitespacePathNormalizer.php normalizePath input validation

Summaryinfo

A vulnerability categorized as problematic has been discovered in PHP League Flysystem up to 3.35.2. This issue affects the function normalizePath of the file src/WhitespacePathNormalizer.php of the component WhitespacePathNormalizer. The manipulation results in input validation. This vulnerability is identified as CVE-2026-102601. The attack can be executed remotely. There is not any exploit available. It is advisable to upgrade the affected component.

Detailsinfo

A vulnerability classified as problematic has been found in PHP League Flysystem up to 3.35.2. Affected is the function normalizePath of the file src/WhitespacePathNormalizer.php of the component WhitespacePathNormalizer. The manipulation with an unknown input leads to a input validation vulnerability. CWE is classifying the issue as CWE-20. The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly. This is going to have an impact on integrity. CVE summarizes:

Flysystem is an open source file storage library for PHP. Prior to 3.35.3, the default WhitespacePathNormalizer in src/WhitespacePathNormalizer.php used by Filesystem across adapters calls preg_match with the u modifier and treats both false and 0 as falsy. A path containing malformed UTF-8 causes PCRE to return false, so paths that also contain control characters bypass CorruptedPathDetected::forPath() in normalizePath(). Filesystem::write() can store such names and Filesystem::listContents() can return the raw ANSI escape sequences, allowing hidden or spoofed terminal file listings when an administrator displays them. This issue is fixed in version 3.35.3.

The advisory is available at github.com. This vulnerability is traded as CVE-2026-102601 since 09/29/2026. The exploitability is told to be easy. It is possible to launch the attack remotely. Successful exploitation requires user interaction by the victim. Technical details are known, but there is no available exploit.

By approaching the search of inurl:src/WhitespacePathNormalizer.php it is possible to find vulnerable targets with Google Hacking.

Upgrading to version 3.35.3 eliminates this vulnerability.

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Productinfo

Type

• Programming Language Software

Vendor

• PHP League

Name

• Flysystem

Version

• 3.35.0
• 3.35.1
• 3.35.2

License

• open-source

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion