Vulnerability record/PUBLISHED/Published Feb 26, 2026 15:33:23 UTC

CVE-2026-28295

A flaw was found in the FTP GVfs backend. A malicious FTP server can exploit this vulnerability by providing an arbitrary IP address and port in its passive mode (PASV) response. The client unconditionally trusts this information and attempts to connect to the specified endpoint, allowing the malicious server to probe for open ports accessible from the client's network.

Base score4.3/ 10

SeverityMediumCVSS 3.1

Exploitability / impact

CVSS metric breakdown

Vector-derived attributes

Base severityMedium

Attack vectorNetworkAV

Attack complexityLowAC

Privileges requiredNonePR

User interactionRequiredUI

ScopeUnchangedS

Confidentiality impactLowC

Integrity impactNoneI

Availability impactNoneA

CVSS vector stringCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

CVSS communicates standardized severity and impact characteristics. It does not establish whether a system is exploitable in your specific environment.

Record context

CVE Numbering Authorityredhat

Last updatedNov 6, 2026 18:23:51 UTC

PublishedFeb 26, 2026 15:33:23 UTC

ReservedFeb 26, 2026 13:34:41 UTC

Credits

Red Hat would like to thank Codean Labs for reporting this issue.