CVE-2026-28296
Medium · 4.3CVSS
4.3
EPSS
0.5%
Published
Feb 26, 2026
CISA due date
—
The record
A flaw was found in the FTP GVfs backend. A remote attacker could exploit this input validation vulnerability by supplying specially crafted file paths containing carriage return and line feed (CRLF) sequences. These unsanitized sequences allow the attacker to terminate intended FTP commands and inject arbitrary FTP commands, potentially leading to arbitrary code execution or other severe impacts.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| SUSE:Linux Enterprise Module for Desktop Applications 15 SP7 | gvfs | 0 | 1.52.2-150600.3.3.1 |
| SUSE:Linux Enterprise Server 15 SP6-LTSS | gvfs | 0 | 1.52.2-150600.3.3.1 |
| SUSE:Linux Enterprise Server for SAP Applications 15 SP6 | gvfs | 0 | 1.52.2-150600.3.3.1 |
| openSUSE:Leap 15.6 | gvfs | 0 | 1.52.2-150600.3.3.1 |
| openSUSE:Leap 16.0 | gnome-online-accounts | 0 | 3.58.0-160000.1.1 |
| openSUSE:Leap 16.0 | gvfs | 0 | 1.59.90-160000.1.1 |
| openSUSE:Tumbleweed | gvfs | 0 | 1.58.2-1.1 |
Related vulnerabilities
- CVE-2026-28295 A flaw was found in the FTP GVfs backend. Also affects gvfs
- CVE-2026-114720 Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by an IMAP command… CWE-93
- CVE-2026-55467 OpenPrinting CUPS is an open source printing system for Linux and other Unix-like… CWE-93
- CVE-2026-102938 virtualenv is a tool for creating isolated virtual python environments. CWE-93
- CVE-2026-86813 The MetForm WordPress plugin before 4.1.9 does not properly neutralize newline characters… CWE-93
- CVE-2026-19862 The JetFormBuilder WordPress plugin before 3.6.5.2 does not validate or strip line breaks… CWE-93
- CVE-2026-48019 Laravel is a web application framework. CWE-93
- CVE-2026-75925 Improper neutralization of CRLF sequences in IXON VPN Client before version 1.4.7 allows… CWE-93