CVE-2026-28295

EUVD-2026-8860
A flaw was found in the FTP GVfs backend. A malicious FTP server can exploit this vulnerability by providing an arbitrary IP address and port in its passive mode (PASV) response. The client unconditionally trusts this information and attempts to connect to the specified endpoint, allowing the malicious server to probe for open ports accessible from the client's network.
SSRF
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
4.3 MEDIUM
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
Awaiting analysis
This vulnerability is currently awaiting analysis.
Base Score
CVSS 3.x
EPSS Score
Percentile: 14%
Debian logo
Debian Releases
Debian Product
Codename
gvfs
bookworm
1.50.3-1+deb12u1
fixed
bullseye
vulnerable
bullseye (security)
1.46.2-2+deb11u1
fixed
forky
1.60.0-1
fixed
sid
1.60.0-1
fixed
trixie
1.57.2-2+deb13u1
fixed
openSUSE logo
openSUSE / SLES Releases
openSUSE Product
Release
gvfs
suse enterprise desktop 15 SP7
1.52.2-150600.3.3.1
fixed
suse enterprise sap 15 SP4
1.48.2-150400.4.9.1
fixed
suse enterprise sap 15 SP5
1.48.2-150400.4.9.1
fixed
suse enterprise sap 15 SP7
1.52.2-150600.3.3.1
fixed
suse enterprise server 12 SP3
1.28.3-18.9.1
fixed
suse enterprise server 12 SP5
1.28.3-18.9.1
fixed
suse enterprise server 15 SP4
1.48.2-150400.4.9.1
fixed
suse enterprise server 15 SP5
1.48.2-150400.4.9.1
fixed
suse enterprise server 15 SP6
1.52.2-150600.3.3.1
fixed
suse enterprise server 15 SP7
1.52.2-150600.3.3.1
fixed
gvfs-backend-afc
suse enterprise desktop 15 SP7
1.52.2-150600.3.3.1
fixed
suse enterprise sap 15 SP4
1.48.2-150400.4.9.1
fixed
suse enterprise sap 15 SP5
1.48.2-150400.4.9.1
fixed
suse enterprise sap 15 SP7
1.52.2-150600.3.3.1
fixed
suse enterprise server 15 SP4
1.48.2-150400.4.9.1
fixed
suse enterprise server 15 SP5
1.48.2-150400.4.9.1
fixed
suse enterprise server 15 SP6
1.52.2-150600.3.3.1
fixed
suse enterprise server 15 SP7
1.52.2-150600.3.3.1
fixed
gvfs-backend-samba
suse enterprise desktop 15 SP7
1.52.2-150600.3.3.1
fixed
suse enterprise sap 15 SP4
1.48.2-150400.4.9.1
fixed
suse enterprise sap 15 SP5
1.48.2-150400.4.9.1
fixed
suse enterprise sap 15 SP7
1.52.2-150600.3.3.1
fixed
suse enterprise server 12 SP3
1.28.3-18.9.1
fixed
suse enterprise server 12 SP5
1.28.3-18.9.1
fixed
suse enterprise server 15 SP4
1.48.2-150400.4.9.1
fixed
suse enterprise server 15 SP5
1.48.2-150400.4.9.1
fixed
suse enterprise server 15 SP6
1.52.2-150600.3.3.1
fixed
suse enterprise server 15 SP7
1.52.2-150600.3.3.1
fixed
gvfs-backends
suse enterprise desktop 15 SP7
1.52.2-150600.3.3.1
fixed
suse enterprise sap 15 SP4
1.48.2-150400.4.9.1
fixed
suse enterprise sap 15 SP5
1.48.2-150400.4.9.1
fixed
suse enterprise sap 15 SP7
1.52.2-150600.3.3.1
fixed
suse enterprise server 12 SP3
1.28.3-18.9.1
fixed
suse enterprise server 12 SP5
1.28.3-18.9.1
fixed
suse enterprise server 15 SP4
1.48.2-150400.4.9.1
fixed
suse enterprise server 15 SP5
1.48.2-150400.4.9.1
fixed
suse enterprise server 15 SP6
1.52.2-150600.3.3.1
fixed
suse enterprise server 15 SP7
1.52.2-150600.3.3.1
fixed
gvfs-devel
suse enterprise desktop 15 SP7
1.52.2-150600.3.3.1
fixed
suse enterprise sap 15 SP4
1.48.2-150400.4.9.1
fixed
suse enterprise sap 15 SP5
1.48.2-150400.4.9.1
fixed
suse enterprise sap 15 SP7
1.52.2-150600.3.3.1
fixed
suse enterprise server 12 SP5
1.28.3-18.9.1
fixed
suse enterprise server 15 SP4
1.48.2-150400.4.9.1
fixed
suse enterprise server 15 SP5
1.48.2-150400.4.9.1
fixed
suse enterprise server 15 SP6
1.52.2-150600.3.3.1
fixed
suse enterprise server 15 SP7
1.52.2-150600.3.3.1
fixed
gvfs-fuse
suse enterprise desktop 15 SP7
1.52.2-150600.3.3.1
fixed
suse enterprise sap 15 SP4
1.48.2-150400.4.9.1
fixed
suse enterprise sap 15 SP5
1.48.2-150400.4.9.1
fixed
suse enterprise sap 15 SP7
1.52.2-150600.3.3.1
fixed
suse enterprise server 12 SP3
1.28.3-18.9.1
fixed
suse enterprise server 12 SP5
1.28.3-18.9.1
fixed
suse enterprise server 15 SP4
1.48.2-150400.4.9.1
fixed
suse enterprise server 15 SP5
1.48.2-150400.4.9.1
fixed
suse enterprise server 15 SP6
1.52.2-150600.3.3.1
fixed
suse enterprise server 15 SP7
1.52.2-150600.3.3.1
fixed
gvfs-lang
suse enterprise desktop 15 SP7
1.52.2-150600.3.3.1
fixed
suse enterprise sap 15 SP4
1.48.2-150400.4.9.1
fixed
suse enterprise sap 15 SP5
1.48.2-150400.4.9.1
fixed
suse enterprise sap 15 SP7
1.52.2-150600.3.3.1
fixed
suse enterprise server 12 SP3
1.28.3-18.9.1
fixed
suse enterprise server 12 SP5
1.28.3-18.9.1
fixed
suse enterprise server 15 SP4
1.48.2-150400.4.9.1
fixed
suse enterprise server 15 SP5
1.48.2-150400.4.9.1
fixed
suse enterprise server 15 SP6
1.52.2-150600.3.3.1
fixed
suse enterprise server 15 SP7
1.52.2-150600.3.3.1
fixed
Common Weakness Enumeration
References
https://access.redhat.com/security/cve/CVE-2026-28295
https://bugzilla.redhat.com/show_bug.cgi?id=2443004