CVE-2026-28295: Gvfs: gvfs ftp backend: information disclosure via untrusted pasv responses
A flaw was found in the FTP GVfs backend. A malicious FTP server can exploit this vulnerability by providing an arbitrary IP address and port in its passive mode (PASV) response. The client unconditionally trusts this information and attempts to connect to the specified endpoint, allowing the malicious server to probe for open ports accessible from the client's network.
Other sources
The FTP GVfs backend in daemon/gvfsftptask.c:868-907 unconditionally trusts the IP address and port returned in PASV responses from FTP servers. When handling passive mode data transfers, the code parses the server's PASV reply and directly constructs a GInetSocketAddress without validating that the advertised IP matches the control connection or restricting private/internal addresses. The client then connects to this arbitrary endpoint via gvfsftpconnectionopendataconnection(). This allows an attacker (the malicious server) to probe the existence of open ports accessible to the client.
— Red Hat
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-28295?
CVE-2026-28295 has a moderate severity level due to its potential for information disclosure.
How do I fix CVE-2026-28295?
To fix CVE-2026-28295, update the GVfs package to the latest version that addresses this vulnerability.
What does CVE-2026-28295 affect?
CVE-2026-28295 affects the FTP backend of the GVfs library.
How can CVE-2026-28295 be exploited?
CVE-2026-28295 can be exploited by a malicious FTP server providing untrusted PASV responses, leading to arbitrary IP address and port disclosure.
Is my data safe with CVE-2026-28295?
Data may not be safe with CVE-2026-28295 as it poses risks of information disclosure if exploited.