CVE-2026-28295

Publication date 26 February 2026

Last updated 23 March 2026

Ubuntu priority

Medium

Why this priority?

Cvss 3 Severity Score

4.3 · Medium

Score breakdown

Description

A flaw was found in the FTP GVfs backend. A malicious FTP server can exploit this vulnerability by providing an arbitrary IP address and port in its passive mode (PASV) response. The client unconditionally trusts this information and attempts to connect to the specified endpoint, allowing the malicious server to probe for open ports accessible from the client's network.

Status

Package Ubuntu Release Status
gvfs 26.04 LTS resolute
Not affected
25.10 questing
Fixed 1.57.2-2ubuntu5.1
24.04 LTS noble
Fixed 1.54.4-0ubuntu1~24.04.2
22.04 LTS jammy
Fixed 1.48.2-0ubuntu1.1
20.04 LTS focal
Needs evaluation
18.04 LTS bionic
Needs evaluation
16.04 LTS xenial
Needs evaluation

Patch details

For informational purposes only. We recommend not to cherry-pick updates. How can I get the fixes?

Package Patch details
gvfs

Severity score breakdown

CVSS version: CVSS v3.0

Base score 4.3 · Medium

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

References

Related Ubuntu Security Notices (USN)

Other references

Access our resources on patching vulnerabilities