CVE-2026-28296: Gvfs: ftp gvfs backend: arbitrary ftp command injection via crlf sequences in file paths
A flaw was found in the FTP GVfs backend. A remote attacker could exploit this input validation vulnerability by supplying specially crafted file paths containing carriage return and line feed (CRLF) sequences. These unsanitized sequences allow the attacker to terminate intended FTP commands and inject arbitrary FTP commands, potentially leading to arbitrary code execution or other severe impacts.
Other sources
The FTP GVfs backend fails to sanitize CRLF sequences in user supplied file paths before constructing FTP protocol commands. When gvfsftpfilenewfromgvfs() creates a file object in daemon/gvfsftpfile.c:77-87, it copies the path without validation. This unsanitized path flows through gvfsftpfilegetftppath() into command format strings like "RETR %s" at daemon/gvfsbackendftp.c:883. In daemon/gvfsftptask.c:661, gstringappendvprintf() includes the malicious path directly into the command buffer, allowing embedded \r\n sequences to terminate the intended command and inject arbitrary FTP commands.
— Red Hat
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-28296?
CVE-2026-28296 is considered a critical severity vulnerability due to its potential for arbitrary command injection.
How do I fix CVE-2026-28296?
To mitigate CVE-2026-28296, ensure that your gvfs package is updated to the latest version where the vulnerability has been addressed.
What types of attacks can CVE-2026-28296 facilitate?
CVE-2026-28296 can facilitate remote command injection attacks through crafted file paths containing CRLF sequences.
Who is affected by CVE-2026-28296?
Users and systems utilizing the GVfs FTP backend are affected by CVE-2026-28296.
What input validation issue is present in CVE-2026-28296?
CVE-2026-28296 exposes a flaw in input validation, permitting specially crafted file paths with CRLF sequences.