Flysystem EUVD-2026-88998

Requires all of the following: (1) the attacker can write a file whose name they control through a Flysystem-backed operation (Filesystem::write()), i.e. some authenticated or exposed write path (PR:L); (2) the crafted filename contains malformed UTF-8 that makes PCRE's preg_match with the u modifier return false, combined with control/ANSI escape bytes - this is what bypasses the pre-3.35.3 WhitespacePathNormalizer check in src/WhitespacePathNormalizer.php; and (3) an administrator subsequently renders Filesystem::listContents() output in an ANSI-interpreting terminal (UI:R) for the escape sequences to have any effect. Limiting factors: only the default WhitespacePathNormalizer versions before 3.35.3 are affected, impact is confined to spoofed/hidden terminal listings (no code execution, no data disclosure), and the payload has no effect if listings are viewed in a sanitized UI or non-terminal context.

This is a genuinely low-severity issue and the signals are internally consistent. The vendor CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N = 3.5) correctly captures a limited-integrity flaw with no confidentiality or availability impact: the only consequence is that control characters and ANSI escape sequences survive path normalization and can be written into stored filenames, then rendered when an administrator lists directory contents in a terminal. Exploitation requires the attacker to already have file-write privileges through the application (PR:L) AND requires an out-of-band human action - an admin viewing the listing in an ANSI-capable terminal (UI:R). There is no EPSS score, no CISA KEV listing, and no public exploit code provided in the intelligence, so this is 'no public exploit identified at time of analysis.' The root cause is confirmed by the vendor advisory (GHSA-cxf4-7mrp-vvpr) and the commit diff, which shows the exact bug: preg_match('#\p{C}+#u', ...) returns false on malformed UTF-8, and the original code treated both false and 0 as 'no control chars found,' letting malformed-UTF-8-plus-control-char paths bypass CorruptedPathDetected::forPath(). Despite Flysystem's ubiquity in the PHP ecosystem, the narrow trigger (write access + terminal display + malformed UTF-8) and cosmetic/spoofing impact make this a low real-world priority, not a high-urgency item. The 'Authentication Bypass' tag is inaccurate and overstates the nature of the flaw.

An attacker with the ability to write files through a Flysystem-backed feature (e.g. a user upload or a filename they control) crafts a filename containing malformed UTF-8 followed by control/ANSI escape bytes (as in the regression test's 'foo\x80\x1bbar'). Because the normalizer fails to reject it, Filesystem::write() stores the name and Filesystem::listContents() later returns the raw escape sequences; when an administrator inspects the listing in a terminal, the escapes execute, hiding or spoofing filenames. No public exploit code is identified, and successful abuse depends on the admin viewing output in an ANSI-interpreting terminal.