CVE-2026-28296 Gvfs: ftp gvfs backend: arbitrary ftp command injection via crlf sequences in file paths
Remote attackers can inject arbitrary FTP commands via CRLF sequences in file paths, potentially leading to arbitrary code execution.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-28296?
CVE-2026-28296 is a medium-severity command injection vulnerability in Red Hat Enterprise Linux 10, published on 26 Feb 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
A flaw was found in the FTP GVfs backend. A remote attacker could exploit this input validation vulnerability by supplying specially crafted file paths containing carriage return and line feed (CRLF) sequences. These unsanitized sequences allow the attacker to terminate intended FTP commands and inject arbitrary FTP commands, potentially leading to arbitrary code execution or other severe impacts.
Weakness: CWE-93
Which versions are affected by CVE-2026-28296?
How do I fix CVE-2026-28296?
Apply the vendor's patch.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2026-28296 being exploited?
There is no known exploitation of CVE-2026-28296 in the wild and no public exploit code.
Sources
Also known as DEBIAN-CVE-2026-28296, GHSA-r8j5-pj3m-qhpv, OESA-2026-2570, OESA-2026-2571, OESA-2026-2670, UBUNTU-CVE-2026-28296.