Input validation error in Flysystem - CVE-2026-102601
Published: November 6, 2026
Vulnerability identifier: #VU159640
CSH Severity: Low
CVSS v4: 4.8 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-102601
CWE-ID: CWE-20
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a low-privileged remote attacker to spoof or hide filenames in terminal listings viewed by an administrator.
The vulnerability exists due to improper validation in Flysystem's default WhitespacePathNormalizer, which accepts control characters when a path contains malformed UTF-8. A low-privileged remote attacker can upload a file with a preserved malicious filename whose escape sequences manipulate output when an administrator displays raw filenames in a terminal.
Affected software
Flysystem
How to mitigate CVE-2026-102601
Install security update from vendor's website.
Flysystem - update to 3.35.3