Flysystem
Monthly
Malformed UTF-8 in a filename can bypass the control-character check performed by Flysystem's default WhitespacePathNormalizer before version 3.35.3, letting a filename containing ANSI escape sequences survive normalization and be stored via Filesystem::write(). When an administrator later renders Filesystem::listContents() output in an ANSI-interpreting terminal, those sequences can hide or spoof entries in the listing, giving a malicious write-capable user (PR:L) a terminal-output deception primitive with UI:R. The issue is confined to spoofed or hidden directory listings - there is no code execution, no data disclosure, and no integrity impact beyond the stored filename itself; no public exploit code has been identified at time of analysis and there is no confirmed active exploitation, and the CVSS 3.5 score reflects the low overall risk.
Flysystem is an open source file storage library for PHP. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, no authentication required.
Malformed UTF-8 in a filename can bypass the control-character check performed by Flysystem's default WhitespacePathNormalizer before version 3.35.3, letting a filename containing ANSI escape sequences survive normalization and be stored via Filesystem::write(). When an administrator later renders Filesystem::listContents() output in an ANSI-interpreting terminal, those sequences can hide or spoof entries in the listing, giving a malicious write-capable user (PR:L) a terminal-output deception primitive with UI:R. The issue is confined to spoofed or hidden directory listings - there is no code execution, no data disclosure, and no integrity impact beyond the stored filename itself; no public exploit code has been identified at time of analysis and there is no confirmed active exploitation, and the CVSS 3.5 score reflects the low overall risk.
Flysystem is an open source file storage library for PHP. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, no authentication required.