Threats affecting pkg:composer/thephpleague/flysystem

1 threat

Severity	CVSS	Signals	Threat	Source	Published	Score and star
Low	3.5	EPSS 0.3%	CVE-2026-102601thephpleague flysystem · Improper Neutralization of Escape, Meta, or Control Sequences Low3.5EPSS 0.3%2026-09-29CVE Database V5CVE-2026-102601 CVE-2026-102601 affects thephpleague flysystem, an open source PHP file storage library. Prior to version 3.35.3, the default WhitespacePathNormalizer improperly handles paths containing malformed UTF-8 sequences. This allows certain control characters and raw ANSI escape sequences to bypass path normalization checks, potentially resulting in hidden or spoofed terminal file listings when administrators view directory contents. The issue is fixed in version 3.35.3. EPSS 0.3%Vulnerability CWE-150 #ghsa-cxf4-7mrp-vvpr #packagist	CVE Database V5	2026-09-29

Page 1 of 1