CVE-2026-102601
LowAdvisory
Published 29 Sept 2026In the index since 30 Sept 2026
- Severity
- Low
- worst across findings
- CVSS
- 3.5
- base score, highest
- EPSS
- —
- probability of exploitation
- CISA KEV
- Not listed
- no confirmed exploitation
- Charts affected
- 70
- of 17,957 indexed, latest versions
- Container images
- 60
- deployed by those charts
- Fix available
- 1 of 1
- affected package
Flysystem: WhitespacePathNormalizer's control-character (CorruptedPathDetected) check is bypassed by malformed UTF-8 in the path, affecting every adapter
Carried by container images the latest versions of 70 of 17,957 indexed charts deploy, on 60 images.
| Affected package | Affected versions | Fixed in | Images |
|---|---|---|---|
| league/ | 1.0.37, 1.0.45, 1.0.70, 1.1.3+21 more | 3.35.3 | 60 |
- OSV records
- GHSA-cxf4-7mrp-vvpr
Charts affected
70 by stars
Container images carrying it
60 by charts deploying them
A fixed version is listed for 1 of the 1 affected package.
| Container image | Digest | Package | Fixed in | Used by |
|---|---|---|---|---|
| ghcr.io/ | 947882bf2c37 | league/ | 3.35.3 | 5 |
| cachethq/ | a61ff0f67ea7 | league/ | 3.35.3 | 4 |
| buddy/ | 097c897f8b54 | league/ | 3.35.3 | 3 |
| fireflyiii/ | fe4ecec4c2ba | league/ | 3.35.3 | 2 |
| fireflyiii/ | ab52bf932546 | league/ | 3.35.3 | 2 |
| passbolt/ | 655547e17263 | league/ | 3.35.3 | 2 |
| akaunting/ | 52811b36ec3a | league/ | 3.35.3 | 1 |
| akaunting/ | e7d5c245b1a0 | league/ | 3.35.3 | 1 |
| anonaddy/ | 957a95565166 | league/ | 3.35.3 | 1 |
| cspconsole/ | 46dda4a31bd6 | league/ | 3.35.3 | 1 |
| espocrm/ | 1b5a24504ed9 | league/ | 3.35.3 | 1 |
| espocrm/ | 4bd92daf5f0c | league/ | 3.35.3 | 1 |
| filegator/ | 34bf565a11a4 | league/ | 3.35.3 | 1 |
| fireflyiii/ | 2f4283bd0cf7 | league/ | 3.35.3 | 1 |
| fireflyiii/ | ae69fdd95cde | league/ | 3.35.3 | 1 |
| fireflyiii/ | c0300cfd3d76 | league/ | 3.35.3 | 1 |
| fireflyiii/ | 65500ce0fe66 | league/ | 3.35.3 | 1 |
| ibarreche/ | e16a469c5791 | league/ | 3.35.3 | 1 |
| invoiceninja/ | 1437916dee01 | league/ | 3.35.3 | 1 |
| leantime/ | ad4bfb0699d3 | league/ | 3.35.3 | 1 |
| library/ | b2d4efc7c2b3 | league/ | 3.35.3 | 1 |
| library/ | ceb1ba4196ab | league/ | 3.35.3 | 1 |
| library/ | 55de721417c1 | league/ | 3.35.3 | 1 |
| library/ | 96104cb965fc | league/ | 3.35.3 | 1 |
| librenms/ | 0920bc9117a8 | league/ | 3.35.3 | 1 |
| librenms/ | 4f1f3d667cc7 | league/ | 3.35.3 | 1 |
| librenms/ | 814e3fb8d837 | league/ | 3.35.3 | 1 |
| linkstackorg/ | 1c8b05399ee4 | league/ | 3.35.3 | 1 |
| linkstackorg/ | abd691b4293b | league/ | 3.35.3 | 1 |
| linuxserver/ | 2ebf97852661 | league/ | 3.35.3 | 1 |
| linuxserver/ | 4c2b77d7e391 | league/ | 3.35.3 | 1 |
| linuxserver/ | 71597f4461e4 | league/ | 3.35.3 | 1 |
| lycheeorg/ | 308c0e6231da | league/ | 3.35.3 | 1 |
| mautic/ | 94ea4acf4049 | league/ | 3.35.3 | 1 |
| mautic/ | eb8cc73d97e1 | league/ | 3.35.3 | 1 |
| michaelepitech/ | af51d61c19f5 | league/ | 3.35.3 | 1 |
| n22107670/ | 8f3072db7aeb | league/ | 3.35.3 | 1 |
| owncloud/ | 51d9b74fc2a8 | league/ | 3.35.3 | 1 |
| owncloud/ | 74c53d341076 | league/ | 3.35.3 | 1 |
| owncloud/ | b3f9efdcd7f7 | league/ | 3.35.3 | 1 |
| passbolt/ | ec046e112d5c | league/ | 3.35.3 | 1 |
| pe46dro/ | 09dfe3aa10f6 | league/ | 3.35.3 | 1 |
| phntom/ | f881ea5fbbf1 | league/ | 3.35.3 | 1 |
| shivani446/ | c0d07b7b4c8d | league/ | 3.35.3 | 1 |
| shyim/ | a951c0e6b836 | league/ | 3.35.3 | 1 |
| snipe/ | 141ebf2386fe | league/ | 3.35.3 | 1 |
| snipe/ | 55fb7636a98c | league/ | 3.35.3 | 1 |
| solidnerd/ | 762ffd5c51d3 | league/ | 3.35.3 | 1 |
| ghcr.io/ | 896e4926e0d7 | league/ | 3.35.3 | 1 |
| ghcr.io/ | cc795b254b73 | league/ | 3.35.3 | 1 |