StackRadar

CVE-2026-102601

Low

Advisory

Published 29 Sept 2026In the index since 30 Sept 2026
Severity
Low
worst across findings
CVSS
3.5
base score, highest
EPSS
—
probability of exploitation
CISA KEV
Not listed
no confirmed exploitation
Charts affected
70
of 17,957 indexed, latest versions
Container images
60
deployed by those charts
Fix available
1 of 1
affected package

Flysystem: WhitespacePathNormalizer's control-character (CorruptedPathDetected) check is bypassed by malformed UTF-8 in the path, affecting every adapter

Carried by container images the latest versions of 70 of 17,957 indexed charts deploy, on 60 images.

Affected packageAffected versionsFixed inImages
league/flysystemcomposer1.0.37, 1.0.45, 1.0.70, 1.1.3+21 more3.35.360
OSV records
GHSA-cxf4-7mrp-vvpr

Charts affected

70 by stars
ChartLatestAffected imagesRadar Score
snipeitt3n3.4.11 of 2See more

snipeit t3n 3.4.1

1 of the 2 container images this version deploys carry CVE-2026-102601.

Container imageDigestPackageFixed in
snipe/snipe-it:v6.0.1455fb7636a98c
league/flysystem@1.1.9
3.35.3

Open the chart page →

91,070
mauticone-acre-fundVerified publisher0.1.71 of 3See more

mautic one-acre-fund 0.1.7

1 of the 3 container images this version deploys carry CVE-2026-102601.

Container imageDigestPackageFixed in
mautic/mautic:v4-apache94ea4acf4049
league/flysystem@1.1.9
3.35.3

Open the chart page →

3,134
monicamonicaOfficialVerified publisher1.0.151 of 1See more

monica monica 1.0.15

1 of the 1 container images this version deploys carry CVE-2026-102601.

Container imageDigestPackageFixed in
ghcr.io/monicahq/monica-next:main8be69156acbb
league/flysystem@3.30.0
3.35.3

Open the chart page →

6,125
passboltcnieg1.1.171 of 2See more

passbolt cnieg 1.1.17

1 of the 2 container images this version deploys carry CVE-2026-102601.

Container imageDigestPackageFixed in
passbolt/passbolt:3.4.0-ce-non-root655547e17263
league/flysystem@2.3.1
3.35.3

Open the chart page →

3,585
bookstackgabe565Verified publisher0.20.01 of 1See more

bookstack gabe565 0.20.0

1 of the 1 container images this version deploys carry CVE-2026-102601.

Container imageDigestPackageFixed in
ghcr.io/linuxserver/bookstack:version-v24.12.1cc795b254b73
league/flysystem@3.29.1
3.35.3

Open the chart page →

2,965
invoiceninjainvoiceninjaVerified publisher0.10.21 of 5See more

invoiceninja invoiceninja 0.10.2

1 of the 5 container images this version deploys carry CVE-2026-102601.

Container imageDigestPackageFixed in
invoiceninja/invoiceninja:5.6.241437916dee01
league/flysystem@3.15.1
3.35.3

Open the chart page →

2,751
bookstackbookstack-mgVerified publisher0.3.11 of 2See more

bookstack bookstack-mg 0.3.1

1 of the 2 container images this version deploys carry CVE-2026-102601.

Container imageDigestPackageFixed in
linuxserver/bookstack:26.05.202605282ebf97852661
league/flysystem@3.34.0
3.35.3

Open the chart page →

1,933
cachetdeliveryheroVerified publisher1.3.51 of 2See more

cachet deliveryhero 1.3.5

1 of the 2 container images this version deploys carry CVE-2026-102601.

Container imageDigestPackageFixed in
cachethq/docker:2.3.15a61ff0f67ea7
league/flysystem@1.0.45
3.35.3

Open the chart page →

1,920
laravelrenoki-co1.0.01 of 2See more

laravel renoki-co 1.0.0

1 of the 2 container images this version deploys carry CVE-2026-102601.

Container imageDigestPackageFixed in
quay.io/renokico/laravel-helm-demo:0.6.03207f957e80c
league/flysystem@1.1.3
3.35.3

Open the chart page →

7,014
repmanszpadel-chartsVerified publisher3.52.171 of 3See more

repman szpadel-charts 3.52.17

1 of the 3 container images this version deploys carry CVE-2026-102601.

Container imageDigestPackageFixed in
buddy/repman:1.4.0097c897f8b54
league/flysystem@1.1.9
3.35.3

Open the chart page →

7,439
passbolt-hachristianhuthVerified publisher6.0.11 of 4See more

passbolt-ha christianhuth 6.0.1

1 of the 4 container images this version deploys carry CVE-2026-102601.

Container imageDigestPackageFixed in
passbolt/passbolt:3.4.0-ce-non-root655547e17263
league/flysystem@2.3.1
3.35.3

Open the chart page →

11,556
commonground-gatewaycommonground-gateway1.5.41 of 7See more

commonground-gateway commonground-gateway 1.5.4

1 of the 7 container images this version deploys carry CVE-2026-102601.

Container imageDigestPackageFixed in
ghcr.io/conductionnl/commonground-gateway-php:latest947882bf2c37
league/flysystem@2.5.0
3.35.3

Open the chart page →

10,061
akauntingf3k-techVerified publisher1.3121.01 of 4See more

akaunting f3k-tech 1.3121.0

1 of the 4 container images this version deploys carry CVE-2026-102601.

Container imageDigestPackageFixed in
akaunting/akaunting:3.1.21-fpm-alpine-nginxe7d5c245b1a0
league/flysystem@3.30.2
3.35.3

Open the chart page →

4,460
firefly-iiigeek-cookbookVerified publisher0.3.01 of 1See more

firefly-iii geek-cookbook 0.3.0

1 of the 1 container images this version deploys carry CVE-2026-102601.

Container imageDigestPackageFixed in
fireflyiii/core:version-5.6.142f4283bd0cf7
league/flysystem@1.1.9
3.35.3

Open the chart page →

2,357
monicageek-cookbookVerified publisher8.2.01 of 1See more

monica geek-cookbook 8.2.0

1 of the 1 container images this version deploys carry CVE-2026-102601.

Container imageDigestPackageFixed in
library/monica:3.7.0-apacheceb1ba4196ab
league/flysystem@1.1.9
3.35.3

Open the chart page →

2,561
leantimegissilabs1.3.01 of 2See more

leantime gissilabs 1.3.0

1 of the 2 container images this version deploys carry CVE-2026-102601.

Container imageDigestPackageFixed in
leantime/leantime:3.3.3ad4bfb0699d3
league/flysystem@3.29.1
3.35.3

Open the chart page →

6,777
kdiffkdiff-snapshotsVerified publisher0.0.2031 of 2See more

kdiff kdiff-snapshots 0.0.203

1 of the 2 container images this version deploys carry CVE-2026-102601.

Container imageDigestPackageFixed in
filegator/filegator:latest34bf565a11a4
league/flysystem@1.1.10
3.35.3

Open the chart page →

8,700
owncloudkubernetes-homelab-helm-chartsVerified publisher0.1.01 of 3See more

owncloud kubernetes-homelab-helm-charts 0.1.0

1 of the 3 container images this version deploys carry CVE-2026-102601.

Container imageDigestPackageFixed in
owncloud/server:10.16.274c53d341076
league/flysystem@1.1.10
3.35.3

Open the chart page →

10,661
librenmsmidokura-communityVerified publisher0.3.21 of 6See more

librenms midokura-community 0.3.2

1 of the 6 container images this version deploys carry CVE-2026-102601.

Container imageDigestPackageFixed in
librenms/librenms:22.4.14f1f3d667cc7
league/flysystem@1.1.9
3.35.3

Open the chart page →

9,041
snipe-itnicholaswildeVerified publisher1.0.51 of 1See more

snipe-it nicholaswilde 1.0.5

1 of the 1 container images this version deploys carry CVE-2026-102601.

Container imageDigestPackageFixed in
ghcr.io/linuxserver/snipe-it:version-v5.1.8ac091e4c33bd
league/flysystem@1.1.4
3.35.3

Open the chart page →

1,005
opencatalogiopencatalogi1.0.61 of 8See more

opencatalogi opencatalogi 1.0.6

1 of the 8 container images this version deploys carry CVE-2026-102601.

Container imageDigestPackageFixed in
ghcr.io/conductionnl/commonground-gateway-php:latest947882bf2c37
league/flysystem@2.5.0
3.35.3

Open the chart page →

15,484
laravel-octanerenoki-co1.0.01 of 1See more

laravel-octane renoki-co 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-102601.

Container imageDigestPackageFixed in
quay.io/renokico/laravel-helm-demo:octane-0.6.0cad83090c58f
league/flysystem@1.1.3
3.35.3

Open the chart page →

3,697
repmanrepman-helmchartVerified publisher1.0.121 of 3See more

repman repman-helmchart 1.0.12

1 of the 3 container images this version deploys carry CVE-2026-102601.

Container imageDigestPackageFixed in
buddy/repman:1.4.0097c897f8b54
league/flysystem@1.1.9
3.35.3

Open the chart page →

3,677
espocrmtwenty20-helm-chartsVerified publisher2.0.51 of 2See more

espocrm twenty20-helm-charts 2.0.5

1 of the 2 container images this version deploys carry CVE-2026-102601.

Container imageDigestPackageFixed in
espocrm/espocrm:10.0.8-fpm-alpine4bd92daf5f0c
league/flysystem@3.30.2
3.35.3

Open the chart page →

533
cachetadnoctemVerified publisher0.3.31 of 2See more

cachet adnoctem 0.3.3

1 of the 2 container images this version deploys carry CVE-2026-102601.

Container imageDigestPackageFixed in
cachethq/docker:2.3.15a61ff0f67ea7
league/flysystem@1.0.45
3.35.3

Open the chart page →

1,933
linkstackadnoctemVerified publisher0.4.01 of 1See more

linkstack adnoctem 0.4.0

1 of the 1 container images this version deploys carry CVE-2026-102601.

Container imageDigestPackageFixed in
linkstackorg/linkstack:latest1c8b05399ee4
league/flysystem@3.31.0
3.35.3

Open the chart page →

2,228
chart-appchart-app0.3.01 of 2See more

chart-app chart-app 0.3.0

1 of the 2 container images this version deploys carry CVE-2026-102601.

Container imageDigestPackageFixed in
n22107670/sample-app:0.4.08f3072db7aeb
league/flysystem@1.1.10
3.35.3

Open the chart page →

2,235
nextcloudcloudve1.13.01 of 2See more

nextcloud cloudve 1.13.0

1 of the 2 container images this version deploys carry CVE-2026-102601.

Container imageDigestPackageFixed in
library/nextcloud:17.0.0-apache96104cb965fc
league/flysystem@1.0.37
3.35.3

Open the chart page →

3,375
commonground-gatewaycommonground-gateway-frontend0.1.51 of 4See more

commonground-gateway commonground-gateway-frontend 0.1.5

1 of the 4 container images this version deploys carry CVE-2026-102601.

Container imageDigestPackageFixed in
ghcr.io/conductionnl/commonground-gateway-php:latest947882bf2c37
league/flysystem@2.5.0
3.35.3

Open the chart page →

2,856
cspconsolecspconsole1.3.111 of 5See more

cspconsole cspconsole 1.3.11

1 of the 5 container images this version deploys carry CVE-2026-102601.

Container imageDigestPackageFixed in
cspconsole/csp-control-center:1.0.1046dda4a31bd6
league/flysystem@3.33.0
3.35.3

Open the chart page →

13,185
ownclouddjjudas21Verified publisher0.3.231 of 3See more

owncloud djjudas21 0.3.23

1 of the 3 container images this version deploys carry CVE-2026-102601.

Container imageDigestPackageFixed in
owncloud/server:10.16.3b3f9efdcd7f7
league/flysystem@1.1.10
3.35.3

Open the chart page →

11,049
webtreesdjjudas21Verified publisher3.0.01 of 1See more

webtrees djjudas21 3.0.0

1 of the 1 container images this version deploys carry CVE-2026-102601.

Container imageDigestPackageFixed in
ghcr.io/nathanvaughn/webtrees:2.2.6034151b61a80
league/flysystem@3.33.0
3.35.3

Open the chart page →

6,588
heimdallegebackVerified publisher2.0.41 of 1See more

heimdall egeback 2.0.4

1 of the 1 container images this version deploys carry CVE-2026-102601.

Container imageDigestPackageFixed in
linuxserver/heimdall:2.6.371597f4461e4
league/flysystem@3.24.0
3.35.3

Open the chart page →

1,747
espocrmespocrmVerified publisher1.0.11 of 2See more

espocrm espocrm 1.0.1

1 of the 2 container images this version deploys carry CVE-2026-102601.

Container imageDigestPackageFixed in
espocrm/espocrm:9.3.101b5a24504ed9
league/flysystem@3.30.2
3.35.3

Open the chart page →

7,128
supportpalevilgn0me0.1.61 of 1See more

supportpal evilgn0me 0.1.6

1 of the 1 container images this version deploys carry CVE-2026-102601.

Container imageDigestPackageFixed in
public.ecr.aws/supportpal/helpdesk-monolithic:4.0.4573779e57fae
league/flysystem@1.1.9
3.35.3

Open the chart page →

21,537
firefly-iiifirefly-iii1.10.11 of 1See more

firefly-iii firefly-iii 1.10.1

1 of the 1 container images this version deploys carry CVE-2026-102601.

Container imageDigestPackageFixed in
fireflyiii/core:version-6.5.9fe4ecec4c2ba
league/flysystem@3.32.0
3.35.3

Open the chart page →

5,627
firefly-iii-stackfirefly-iii0.10.22 of 4See more

firefly-iii-stack firefly-iii 0.10.2

2 of the 4 container images this version deploys carry CVE-2026-102601.

Container imageDigestPackageFixed in
fireflyiii/core:version-6.5.9fe4ecec4c2ba
league/flysystem@3.32.0
3.35.3
fireflyiii/data-importer:version-2.2.3ab52bf932546
league/flysystem@3.33.0
3.35.3

Open the chart page →

11,425
importerfirefly-iii1.6.01 of 1See more

importer firefly-iii 1.6.0

1 of the 1 container images this version deploys carry CVE-2026-102601.

Container imageDigestPackageFixed in
fireflyiii/data-importer:version-2.2.3ab52bf932546
league/flysystem@3.33.0
3.35.3

Open the chart page →

5,406
linkstackfmjstudios0.2.21 of 1See more

linkstack fmjstudios 0.2.2

1 of the 1 container images this version deploys carry CVE-2026-102601.

Container imageDigestPackageFixed in
linkstackorg/linkstack:latestabd691b4293b
league/flysystem@3.15.1
3.35.3

Open the chart page →

2,736
passboltg0dscookie0.5.21 of 2See more

passbolt g0dscookie 0.5.2

1 of the 2 container images this version deploys carry CVE-2026-102601.

Container imageDigestPackageFixed in
passbolt/passbolt:3.9.0-2-ce-non-rootec046e112d5c
league/flysystem@2.5.0
3.35.3

Open the chart page →

8,247
monicagabe565Verified publisher0.10.01 of 2See more

monica gabe565 0.10.0

1 of the 2 container images this version deploys carry CVE-2026-102601.

Container imageDigestPackageFixed in
library/monica:4.1.2-fpm-alpineb2d4efc7c2b3
league/flysystem@3.27.0
3.35.3

Open the chart page →

609
anonaddygeek-cookbookVerified publisher6.0.01 of 1See more

anonaddy geek-cookbook 6.0.0

1 of the 1 container images this version deploys carry CVE-2026-102601.

Container imageDigestPackageFixed in
anonaddy/anonaddy:0.12.3957a95565166
league/flysystem@3.1.0
3.35.3

Open the chart page →

4,857
bookstackgeek-cookbookVerified publisher5.2.01 of 1See more

bookstack geek-cookbook 5.2.0

1 of the 1 container images this version deploys carry CVE-2026-102601.

Container imageDigestPackageFixed in
ghcr.io/linuxserver/bookstack:version-v21.12f05447347ff1
league/flysystem@1.1.9
3.35.3

Open the chart page →

1,321
lycheegeek-cookbookVerified publisher6.4.21 of 1See more

lychee geek-cookbook 6.4.2

1 of the 1 container images this version deploys carry CVE-2026-102601.

Container imageDigestPackageFixed in
lycheeorg/lychee-laravel:v4.3.0308c0e6231da
league/flysystem@1.1.3
3.35.3

Open the chart page →

628
webtreesgeek-cookbookVerified publisher2.2.01 of 1See more

webtrees geek-cookbook 2.2.0

1 of the 1 container images this version deploys carry CVE-2026-102601.

Container imageDigestPackageFixed in
ghcr.io/nathanvaughn/webtrees:2.0.1969423a100fab
league/flysystem@1.0.70
3.35.3

Open the chart page →

4,321
xbackbonegeek-cookbookVerified publisher5.4.21 of 1See more

xbackbone geek-cookbook 5.4.2

1 of the 1 container images this version deploys carry CVE-2026-102601.

Container imageDigestPackageFixed in
pe46dro/xbackbone-docker:3.3.309dfe3aa10f6
league/flysystem@1.0.70
3.35.3

Open the chart page →

1,674
cachethelm-charts-nr1.3.51 of 2See more

cachet helm-charts-nr 1.3.5

1 of the 2 container images this version deploys carry CVE-2026-102601.

Container imageDigestPackageFixed in
cachethq/docker:2.3.15a61ff0f67ea7
league/flysystem@1.0.45
3.35.3

Open the chart page →

1,920
heimdallhelmforgeVerified publisher1.1.141 of 1See more

heimdall helmforge 1.1.14

1 of the 1 container images this version deploys carry CVE-2026-102601.

Container imageDigestPackageFixed in
linuxserver/heimdall:2.8.34c2b77d7e391
league/flysystem@3.35.2
3.35.3

Open the chart page →

179
fireflyhomeenterpriseinc2.7.02 of 2See more

firefly homeenterpriseinc 2.7.0

2 of the 2 container images this version deploys carry CVE-2026-102601.

Container imageDigestPackageFixed in
fireflyiii/core:version-5.7.12c0300cfd3d76
league/flysystem@3.3.0
3.35.3
fireflyiii/data-importer:version-0.9.1665500ce0fe66
league/flysystem@3.3.0
3.35.3

Open the chart page →

3,313
nextcloudhomeenterpriseinc0.6.01 of 1See more

nextcloud homeenterpriseinc 0.6.0

1 of the 1 container images this version deploys carry CVE-2026-102601.

Container imageDigestPackageFixed in
library/nextcloud:22.0.0-apache55de721417c1
league/flysystem@1.1.3
3.35.3

Open the chart page →

2,343

Container images carrying it

60 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container imageDigestPackageFixed inUsed by
ghcr.io/conductionnl/commonground-gateway-php:latest947882bf2c37
league/flysystem@2.5.0
3.35.3
5
cachethq/docker:2.3.15a61ff0f67ea7
league/flysystem@1.0.45
3.35.3
4
buddy/repman:1.4.0097c897f8b54
league/flysystem@1.1.9
3.35.3
3
fireflyiii/core:version-6.5.9fe4ecec4c2ba
league/flysystem@3.32.0
3.35.3
2
fireflyiii/data-importer:version-2.2.3ab52bf932546
league/flysystem@3.33.0
3.35.3
2
passbolt/passbolt:3.4.0-ce-non-root655547e17263
league/flysystem@2.3.1
3.35.3
2
akaunting/akaunting:3.0.1552811b36ec3a
league/flysystem@3.15.1
3.35.3
1
akaunting/akaunting:3.1.21-fpm-alpine-nginxe7d5c245b1a0
league/flysystem@3.30.2
3.35.3
1
anonaddy/anonaddy:0.12.3957a95565166
league/flysystem@3.1.0
3.35.3
1
cspconsole/csp-control-center:1.0.1046dda4a31bd6
league/flysystem@3.33.0
3.35.3
1
espocrm/espocrm:9.3.101b5a24504ed9
league/flysystem@3.30.2
3.35.3
1
espocrm/espocrm:10.0.8-fpm-alpine4bd92daf5f0c
league/flysystem@3.30.2
3.35.3
1
filegator/filegator:latest34bf565a11a4
league/flysystem@1.1.10
3.35.3
1
fireflyiii/core:version-5.6.142f4283bd0cf7
league/flysystem@1.1.9
3.35.3
1
fireflyiii/core:version-6.6.6ae69fdd95cde
league/flysystem@3.35.1
3.35.3
1
fireflyiii/core:version-5.7.12c0300cfd3d76
league/flysystem@3.3.0
3.35.3
1
fireflyiii/data-importer:version-0.9.1665500ce0fe66
league/flysystem@3.3.0
3.35.3
1
ibarreche/cloud-back-ci:lateste16a469c5791
league/flysystem@1.1.3
3.35.3
1
invoiceninja/invoiceninja:5.6.241437916dee01
league/flysystem@3.15.1
3.35.3
1
leantime/leantime:3.3.3ad4bfb0699d3
league/flysystem@3.29.1
3.35.3
1
library/monica:4.1.2-fpm-alpineb2d4efc7c2b3
league/flysystem@3.27.0
3.35.3
1
library/monica:3.7.0-apacheceb1ba4196ab
league/flysystem@1.1.9
3.35.3
1
library/nextcloud:22.0.0-apache55de721417c1
league/flysystem@1.1.3
3.35.3
1
library/nextcloud:17.0.0-apache96104cb965fc
league/flysystem@1.0.37
3.35.3
1
librenms/librenms:24.11.00920bc9117a8
league/flysystem@3.29.1
3.35.3
1
librenms/librenms:22.4.14f1f3d667cc7
league/flysystem@1.1.9
3.35.3
1
librenms/librenms:26.9.1.1814e3fb8d837
league/flysystem@3.35.2
3.35.3
1
linkstackorg/linkstack:latest1c8b05399ee4
league/flysystem@3.31.0
3.35.3
1
linkstackorg/linkstack:latestabd691b4293b
league/flysystem@3.15.1
3.35.3
1
linuxserver/bookstack:26.05.202605282ebf97852661
league/flysystem@3.34.0
3.35.3
1
linuxserver/heimdall:2.8.34c2b77d7e391
league/flysystem@3.35.2
3.35.3
1
linuxserver/heimdall:2.6.371597f4461e4
league/flysystem@3.24.0
3.35.3
1
lycheeorg/lychee-laravel:v4.3.0308c0e6231da
league/flysystem@1.1.3
3.35.3
1
mautic/mautic:v4-apache94ea4acf4049
league/flysystem@1.1.9
3.35.3
1
mautic/mautic:7-apacheeb8cc73d97e1
league/flysystem@3.34.0
3.35.3
1
michaelepitech/sample-app:latestaf51d61c19f5
league/flysystem@1.1.10
3.35.3
1
n22107670/sample-app:0.4.08f3072db7aeb
league/flysystem@1.1.10
3.35.3
1
owncloud/server:10.15.051d9b74fc2a8
league/flysystem@1.1.10
3.35.3
1
owncloud/server:10.16.274c53d341076
league/flysystem@1.1.10
3.35.3
1
owncloud/server:10.16.3b3f9efdcd7f7
league/flysystem@1.1.10
3.35.3
1
passbolt/passbolt:3.9.0-2-ce-non-rootec046e112d5c
league/flysystem@2.5.0
3.35.3
1
pe46dro/xbackbone-docker:3.3.309dfe3aa10f6
league/flysystem@1.0.70
3.35.3
1
phntom/fireflyiii:version-5.7.5f881ea5fbbf1
league/flysystem@3.0.19
3.35.3
1
shivani446/podcastwala-php:v1c0d07b7b4c8d
league/flysystem@1.0.70
3.35.3
1
shyim/shopware:6.4.6.0a951c0e6b836
league/flysystem@1.1.5
3.35.3
1
snipe/snipe-it:v8.3.1141ebf2386fe
league/flysystem@3.30.0
3.35.3
1
snipe/snipe-it:v6.0.1455fb7636a98c
league/flysystem@1.1.9
3.35.3
1
solidnerd/bookstack:21.12762ffd5c51d3
league/flysystem@1.1.9
3.35.3
1
ghcr.io/cedar2025/xboard:latest896e4926e0d7
league/flysystem@3.32.0
3.35.3
1
ghcr.io/linuxserver/bookstack:version-v24.12.1cc795b254b73
league/flysystem@3.29.1
3.35.3
1

syft 1.42.1 · advisories as of 30 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.