---
id: CVE-2026-28296
title: >-
  Gvfs: ftp gvfs backend: arbitrary ftp command injection via crlf sequences in
  file paths
summary: >-
  A flaw was found in the FTP GVfs backend. A remote attacker could exploit this
  input validation vulnerability by supplying specially crafted file paths
  containing carriage return and line feed (CRLF) sequences. These unsanitized
  sequence…
severity: medium
cvss: 4.3
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N'
cvssSource: cna
cwe:
  - CWE-93
vendor: Red Hat
product: gvfs
affected:
  - gvfs (all versions)
  - gvfs (all versions)
  - gvfs (all versions)
  - gvfs (all versions)
  - gvfs (all versions)
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-02-26T18:22:57.299756Z'
published: '2026-02-26'
updated: '2026-11-05'
sourceUpdated: '2026-11-05T20:10:36.502Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-28296'
references:
  - url: 'https://access.redhat.com/security/cve/CVE-2026-28296'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2443003'
    label: RHBZ#2443003
tags:
  - cve.org
epss: 0.00424
epssPercentile: 0.36846
ingestedAt: '2026-11-05T22:38:31.730Z'
---

## Overview

A flaw was found in the FTP GVfs backend. A remote attacker could exploit this input validation vulnerability by supplying specially crafted file paths containing carriage return and line feed (CRLF) sequences. These unsanitized sequences allow the attacker to terminate intended FTP commands and inject arbitrary FTP commands, potentially leading to arbitrary code execution or other severe impacts.

## Affected

- `gvfs (all versions)`
- `gvfs (all versions)`
- `gvfs (all versions)`
- `gvfs (all versions)`
- `gvfs (all versions)`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

### Workarounds

To reduce the risk associated with this vulnerability, users should avoid connecting to untrusted FTP servers or opening FTP links from unverified sources. Implementing network-level restrictions, such as firewall rules, to limit outbound connections to only trusted FTP servers can further mitigate potential exposure. If the GVfs FTP backend is not essential for daily operations, consider removing or disabling packages that provide this functionality, though this action may affect other desktop environment features that rely on GVfs for FTP access.