CVE-2026-28296

A flaw was found in the FTP GVfs backend. A remote attacker could exploit this input validation vulnerability by supplying specially crafted file paths containing carriage return and line feed (CRLF) sequences. These unsanitized sequences allow the attacker to terminate intended FTP commands and inject arbitrary FTP commands, potentially leading to arbitrary code execution or other severe impacts.

The GVfs FTP backend is vulnerable to command injection due to improper sanitization of user-supplied file paths. An attacker could craft a malicious FTP path containing CRLF sequences to inject arbitrary FTP commands. This primarily impacts systems where users interact with untrusted FTP servers or open specially crafted FTP links through applications utilizing GVfs, typically in desktop environments.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To reduce the risk associated with this vulnerability, users should avoid connecting to untrusted FTP servers or opening FTP links from unverified sources. Implementing network-level restrictions, such as firewall rules, to limit outbound connections to only trusted FTP servers can further mitigate potential exposure. If the GVfs FTP backend is not essential for daily operations, consider removing or disabling packages that provide this functionality, though this action may affect other desktop environment features that rely on GVfs for FTP access.