Thephpleague flysystem prior to version 3.35.3 uses a default WhitespacePathNormalizer that calls preg_match with the 'u' modifier and treats both false and 0 as falsy. When a path contains malformed UTF-8 sequences, PCRE returns false, causing the normalization function to bypass detection of corrupted paths containing control characters. Consequently, Filesystem::write() can store file names with such characters, and Filesystem::listContents() can return raw ANSI escape sequences. This behavior enables hidden or spoofed terminal file listings when administrators display directory contents. The vulnerability is addressed by fixing the normalization logic in version 3.35.3.

This vulnerability allows an attacker to create files with names containing raw ANSI escape sequences that can be hidden or spoofed in terminal file listings. While it does not directly compromise confidentiality or availability, it can mislead administrators by presenting deceptive file listings, potentially complicating system management or forensic analysis. The CVSS score is 3.5 (low severity), indicating limited impact primarily on integrity of displayed file names.

Upgrade thephpleague flysystem to version 3.35.3 or later, where the issue in WhitespacePathNormalizer is fixed. No other mitigations are indicated. Patch status is confirmed fixed in 3.35.3.