CVE WATCH / VULNERABILITY DETAIL
CVE-2026-102601
LOWCVSS 3.5NVD feed
Published 29 September 2026 · tracked since 30 September 2026
Description
Flysystem is an open source file storage library for PHP. Prior to 3.35.3, the default WhitespacePathNormalizer in src/WhitespacePathNormalizer.php used by Filesystem across adapters calls preg_match with the u modifier and treats both false and 0 as falsy. A path containing malformed UTF-8 causes P
References
- NVD — National Vulnerability Database
- CVE.org record (MITRE)
- CISA Known Exploited Vulnerabilities catalog