AIKIDO-2026-155029

TL;DR

The WhitespacePathNormalizer class validates paths by scanning for control characters with a preg_match call that uses the Unicode modifier. When a path contains malformed UTF-8, preg_match returns false instead of a match count, and the truthy check treats that failure as a clean path so CorruptedPathDetected is never thrown. Because this normalizer is the default across the Local, FTP, SFTP, S3, and other adapters, file names carrying invalid UTF-8 bytes together with embedded terminal escape or control sequences pass validation and are stored. The fix compares the preg_match result against zero so both malformed UTF-8 and real matches are rejected as corrupted paths.