Flysystem, a PHP file storage library, uses a default WhitespacePathNormalizer that checks for control characters in file paths. A malformed UTF‑8 string causes the PCRE library to return false, allowing the normalizer to skip its CorruptedPathDetected check. As a result, files can be stored with names that contain ANSI escape sequences, and listContents() will return the raw escape codes. Administrators viewing the list may see hidden or spoofed terminal file listings, potentially confusing file management operations or leaking sensitive information. This flaw does not enable code execution or direct data exfiltration.

The vulnerability impacts all versions of the PHP League’s Flysystem library released before 3.35.3. Any PHP application that uses Flysystem through any adapter without updating to the 3.35.3 release or later is affected.

The CVSS score of 3.5 reflects a low‑severity vulnerability. No EPSS data is available. The vulnerability is not listed in the CISA KEV catalog. Based on the CVE description, exploitation requires an attacker to have write access to the Flysystem instance and to supply a path containing malformed UTF‑8. The CVE data does not mention any network‑exposed entry points, so the flaw is not remotely reachable. Exploitation therefore leads to misleading file listings but does not directly compromise system integrity, confidentiality, or availability.