CVE-2026-28295
Medium · 4.3CVSS
4.3
EPSS
0.3%
Published
Feb 26, 2026
CISA due date
—
The record
A flaw was found in the FTP GVfs backend. A malicious FTP server can exploit this vulnerability by providing an arbitrary IP address and port in its passive mode (PASV) response. The client unconditionally trusts this information and attempts to connect to the specified endpoint, allowing the malicious server to probe for open ports accessible from the client's network.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| SUSE:Linux Enterprise Module for Desktop Applications 15 SP7 | gvfs | 0 | 1.52.2-150600.3.3.1 |
| SUSE:Linux Enterprise Server 15 SP6-LTSS | gvfs | 0 | 1.52.2-150600.3.3.1 |
| SUSE:Linux Enterprise Server for SAP Applications 15 SP6 | gvfs | 0 | 1.52.2-150600.3.3.1 |
| openSUSE:Leap 15.6 | gvfs | 0 | 1.52.2-150600.3.3.1 |
| openSUSE:Leap 16.0 | gnome-online-accounts | 0 | 3.58.0-160000.1.1 |
| openSUSE:Leap 16.0 | gvfs | 0 | 1.59.90-160000.1.1 |
| openSUSE:Tumbleweed | gvfs | 0 | 1.58.2-1.1 |
Related vulnerabilities
- CVE-2026-28296 A flaw was found in the FTP GVfs backend. Also affects gvfs
- CVE-2026-114730 Roundcube Webmail 1.6.14 before 1.6.20 and 1.7.0 before 1.7.5 is affected by a… CWE-918
- CVE-2026-87953 Server-Side Request Forgery (SSRF) vulnerability in Drupal SAML SSO - Service Provider… CWE-918
- CVE-2026-114634 WWBN AVideo before 29.4.0 contains a blind server-side request forgery vulnerability in… CWE-918
- CVE-2026-112288 Krayin CRM 2.2.5 before 2.2.7 contains a server-side request forgery filter bypass that… CWE-918
- CVE-2026-111936 Sigma File Manager through 2.2.0 contains a server-side request forgery vulnerability… CWE-918
- CVE-2026-94483 Next.js is a React framework for building full-stack web applications. CWE-918
- CVE-2026-102267 PyJWT is a Python implementation of JSON Web Token standards. CWE-918