Threats Tagged 'ghsa-cxf4-7mrp-vvpr'

CVE-2026-102601 affects thephpleague flysystem, an open source PHP file storage library. Prior to version 3.35.3, the default WhitespacePathNormalizer improperly handles paths containing malformed UTF-8 sequences. This allows certain control characters and raw ANSI escape sequences to bypass path normalization checks, potentially resulting in hidden or spoofed terminal file listings when administrators view directory contents. The issue is fixed in version 3.35.3.