SB2026110652 - Multiple vulnerabilities in Flysystem

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2026110652

SB2026110652 - Multiple vulnerabilities in Flysystem

Published: November 6, 2026

Security Bulletin ID SB2026110652
CSH Severity
Low
Patch available
YES
Number of vulnerabilities 1
Exploitation vector Remote access
Highest impact Data manipulation

Breakdown by Severity

Low 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 1 vulnerability.


1) Input validation error (CVE-ID: CVE-2026-102601)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 4.8 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a low-privileged remote attacker to spoof or hide filenames in terminal listings viewed by an administrator.

The vulnerability exists due to improper validation in Flysystem's default WhitespacePathNormalizer, which accepts control characters when a path contains malformed UTF-8. A low-privileged remote attacker can upload a file with a preserved malicious filename whose escape sequences manipulate output when an administrator displays raw filenames in a terminal.


Remediation

Install update from vendor's website.

References