StackRadar

CVE-2026-102601

Low

Advisory

Published 29 Sept 2026In the index since 30 Sept 2026
Severity
Low
worst across findings
CVSS
3.5
base score, highest
EPSS
—
probability of exploitation
CISA KEV
Not listed
no confirmed exploitation
Charts affected
70
of 17,957 indexed, latest versions
Container images
60
deployed by those charts
Fix available
1 of 1
affected package

Flysystem: WhitespacePathNormalizer's control-character (CorruptedPathDetected) check is bypassed by malformed UTF-8 in the path, affecting every adapter

Carried by container images the latest versions of 70 of 17,957 indexed charts deploy, on 60 images.

Affected packageAffected versionsFixed inImages
league/flysystemcomposer1.0.37, 1.0.45, 1.0.70, 1.1.3+21 more3.35.360
OSV records
GHSA-cxf4-7mrp-vvpr

Charts affected

70 by stars
ChartLatestAffected imagesRadar Score
firefly-iiikubernetes-homelab-helm-chartsVerified publisher0.1.31 of 3See more

firefly-iii kubernetes-homelab-helm-charts 0.1.3

1 of the 3 container images this version deploys carry CVE-2026-102601.

Container imageDigestPackageFixed in
fireflyiii/core:version-6.6.6ae69fdd95cde
league/flysystem@3.35.1
3.35.3

Open the chart page →

4,767
sample-appkubeuest0.1.31 of 1See more

sample-app kubeuest 0.1.3

1 of the 1 container images this version deploys carry CVE-2026-102601.

Container imageDigestPackageFixed in
michaelepitech/sample-app:latestaf51d61c19f5
league/flysystem@1.1.10
3.35.3

Open the chart page →

1,873
laravel-chartlaravel-application0.2.01 of 1See more

laravel-chart laravel-application 0.2.0

1 of the 1 container images this version deploys carry CVE-2026-102601.

Container imageDigestPackageFixed in
ibarreche/cloud-back-ci:lateste16a469c5791
league/flysystem@1.1.3
3.35.3

Open the chart page →

1,866
librenmslibrenms10.2.01 of 5See more

librenms librenms 10.2.0

1 of the 5 container images this version deploys carry CVE-2026-102601.

Container imageDigestPackageFixed in
librenms/librenms:26.9.1.1814e3fb8d837
league/flysystem@3.35.2
3.35.3

Open the chart page →

2,518
mauticmautic-chartVerified publisher1.0.21 of 3See more

mautic mautic-chart 1.0.2

1 of the 3 container images this version deploys carry CVE-2026-102601.

Container imageDigestPackageFixed in
mautic/mautic:7-apacheeb8cc73d97e1
league/flysystem@3.34.0
3.35.3

Open the chart page →

9,063
akauntingnas-helm-chartsVerified publisher1.0.31 of 2See more

akaunting nas-helm-charts 1.0.3

1 of the 2 container images this version deploys carry CVE-2026-102601.

Container imageDigestPackageFixed in
akaunting/akaunting:3.0.1552811b36ec3a
league/flysystem@3.15.1
3.35.3

Open the chart page →

13,512
librenmsnimbolus0.5.11 of 3See more

librenms nimbolus 0.5.1

1 of the 3 container images this version deploys carry CVE-2026-102601.

Container imageDigestPackageFixed in
librenms/librenms:24.11.00920bc9117a8
league/flysystem@3.29.1
3.35.3

Open the chart page →

2,338
commonground-gatewayopencatalogi1.5.31 of 7See more

commonground-gateway opencatalogi 1.5.3

1 of the 7 container images this version deploys carry CVE-2026-102601.

Container imageDigestPackageFixed in
ghcr.io/conductionnl/commonground-gateway-php:latest947882bf2c37
league/flysystem@2.5.0
3.35.3

Open the chart page →

10,061
firefly-iiiphntom0.2.101 of 2See more

firefly-iii phntom 0.2.10

1 of the 2 container images this version deploys carry CVE-2026-102601.

Container imageDigestPackageFixed in
phntom/fireflyiii:version-5.7.5f881ea5fbbf1
league/flysystem@3.0.19
3.35.3

Open the chart page →

2,054
podcast-helmpodcastwala-helm0.1.01 of 2See more

podcast-helm podcastwala-helm 0.1.0

1 of the 2 container images this version deploys carry CVE-2026-102601.

Container imageDigestPackageFixed in
shivani446/podcastwala-php:v1c0d07b7b4c8d
league/flysystem@1.0.70
3.35.3

Open the chart page →

631
laravel-workerrenoki-co1.1.01 of 1See more

laravel-worker renoki-co 1.1.0

1 of the 1 container images this version deploys carry CVE-2026-102601.

Container imageDigestPackageFixed in
quay.io/renokico/laravel-helm-demo:worker-0.6.04b188259267e
league/flysystem@1.1.3
3.35.3

Open the chart page →

5,765
shopwarerobjuz2.0.01 of 6See more

shopware robjuz 2.0.0

1 of the 6 container images this version deploys carry CVE-2026-102601.

Container imageDigestPackageFixed in
shyim/shopware:6.4.6.0a951c0e6b836
league/flysystem@1.1.5
3.35.3

Open the chart page →

3,009
bookstackschmitzis0.1.11 of 1See more

bookstack schmitzis 0.1.1

1 of the 1 container images this version deploys carry CVE-2026-102601.

Container imageDigestPackageFixed in
solidnerd/bookstack:21.12762ffd5c51d3
league/flysystem@1.1.9
3.35.3

Open the chart page →

3,043
snipeitschmitzis6.1.01 of 2See more

snipeit schmitzis 6.1.0

1 of the 2 container images this version deploys carry CVE-2026-102601.

Container imageDigestPackageFixed in
snipe/snipe-it:v8.3.1141ebf2386fe
league/flysystem@3.30.0
3.35.3

Open the chart page →

69,379
cachetsergiotocaliniVerified publisher1.0.01 of 1See more

cachet sergiotocalini 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-102601.

Container imageDigestPackageFixed in
cachethq/docker:2.3.15a61ff0f67ea7
league/flysystem@1.0.45
3.35.3

Open the chart page →

1,920
commonground-gatewayskeleton-pip0.1.71 of 5See more

commonground-gateway skeleton-pip 0.1.7

1 of the 5 container images this version deploys carry CVE-2026-102601.

Container imageDigestPackageFixed in
ghcr.io/conductionnl/commonground-gateway-php:latest947882bf2c37
league/flysystem@2.5.0
3.35.3

Open the chart page →

2,856
repmanteam-blueVerified publisher0.3.01 of 5See more

repman team-blue 0.3.0

1 of the 5 container images this version deploys carry CVE-2026-102601.

Container imageDigestPackageFixed in
buddy/repman:1.4.0097c897f8b54
league/flysystem@1.1.9
3.35.3

Open the chart page →

4,026
owncloudth-chartsVerified publisher0.2.11 of 1See more

owncloud th-charts 0.2.1

1 of the 1 container images this version deploys carry CVE-2026-102601.

Container imageDigestPackageFixed in
owncloud/server:10.15.051d9b74fc2a8
league/flysystem@1.1.10
3.35.3

Open the chart page →

10,605
apiwbstack0.36.01 of 1See more

api wbstack 0.36.0

1 of the 1 container images this version deploys carry CVE-2026-102601.

Container imageDigestPackageFixed in
ghcr.io/wbstack/api:8x.9.11eee94f9f7a53
league/flysystem@1.1.9
3.35.3

Open the chart page →

2,479
xboardxboard0.2.01 of 1See more

xboard xboard 0.2.0

1 of the 1 container images this version deploys carry CVE-2026-102601.

Container imageDigestPackageFixed in
ghcr.io/cedar2025/xboard:latest896e4926e0d7
league/flysystem@3.32.0
3.35.3

Open the chart page →

1,124

Container images carrying it

60 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container imageDigestPackageFixed inUsed by
ghcr.io/linuxserver/bookstack:version-v21.12f05447347ff1
league/flysystem@1.1.9
3.35.3
1
ghcr.io/linuxserver/snipe-it:version-v5.1.8ac091e4c33bd
league/flysystem@1.1.4
3.35.3
1
ghcr.io/monicahq/monica-next:main8be69156acbb
league/flysystem@3.30.0
3.35.3
1
ghcr.io/nathanvaughn/webtrees:2.2.6034151b61a80
league/flysystem@3.33.0
3.35.3
1
ghcr.io/nathanvaughn/webtrees:2.0.1969423a100fab
league/flysystem@1.0.70
3.35.3
1
ghcr.io/wbstack/api:8x.9.11eee94f9f7a53
league/flysystem@1.1.9
3.35.3
1
public.ecr.aws/supportpal/helpdesk-monolithic:4.0.4573779e57fae
league/flysystem@1.1.9
3.35.3
1
quay.io/renokico/laravel-helm-demo:0.6.03207f957e80c
league/flysystem@1.1.3
3.35.3
1
quay.io/renokico/laravel-helm-demo:worker-0.6.04b188259267e
league/flysystem@1.1.3
3.35.3
1
quay.io/renokico/laravel-helm-demo:octane-0.6.0cad83090c58f
league/flysystem@1.1.3
3.35.3
1

syft 1.42.1 · advisories as of 30 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.