CVE-2026-28295: 
Linux Debian vulnerability analysis and mitigation

CVE-2026-28295 is a Server-Side Request Forgery (SSRF) vulnerability in the GVfs FTP backend that allows a malicious FTP server to probe open ports accessible from the client's network. The flaw exists in daemon/gvfsftptask.c (lines 868–907), where the client unconditionally trusts the IP address and port provided in FTP passive mode (PASV) responses. It was disclosed on February 26, 2026, and affects the gvfs package across multiple Linux distributions including Red Hat Enterprise Linux, SUSE, Ubuntu, Debian, and Slackware. It carries a CVSS v3.1 base score of 4.3 (Medium) (Red Hat CVE, Red Hat Bugzilla).

The root cause is classified as CWE-918 (Server-Side Request Forgery). In daemon/gvfsftptask.c, the GVfs FTP backend parses the server's PASV reply and directly constructs a GInetSocketAddress without validating that the advertised IP matches the control connection or restricting private/internal addresses. The client then connects to this arbitrary endpoint via g_vfs_ftp_connection_open_data_connection(), enabling the malicious server to direct the client to connect to any IP and port combination. Exploitation requires user interaction — a user must connect to a malicious FTP server — but no authentication or special privileges are required on the attacker's side (Red Hat Bugzilla, Red Hat CVE).

A malicious FTP server can exploit this vulnerability to perform network reconnaissance by probing for open ports accessible from the victim client's network. The primary impact is limited confidentiality loss — an attacker can infer network topology and service availability behind the client's network boundary, which could facilitate further targeted attacks. There is no integrity or availability impact, and exploitation is constrained to information disclosure (Red Hat CVE, Red Hat Bugzilla).

No public proof-of-concept exploit code or in-the-wild exploitation has been reported for CVE-2026-28295. The EPSS score is approximately 0.028% (0.000280), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires user interaction (a user must connect to a malicious FTP server), which further limits practical attack scenarios (Red Hat CVE).

1. Set up a malicious FTP server: The attacker configures an FTP server that responds to PASV requests with an arbitrary IP address and port (e.g., an internal network host such as 192.168.1.1:22) instead of the server's own address.
2. Lure the victim: The attacker tricks a user running a vulnerable GVfs-based FTP client (e.g., via a phishing link or malicious bookmark) into connecting to the attacker-controlled FTP server.
3. Trigger passive mode: When the client initiates a file transfer or directory listing, it sends a PASV command. The malicious server responds with the crafted IP and port.
4. Client connects to target: The vulnerable GVfs backend parses the PASV response without validation and calls g_vfs_ftp_connection_open_data_connection() to connect to the attacker-specified endpoint.
5. Port probing: By observing whether the connection succeeds or fails (e.g., via timing or error responses relayed through the FTP session), the attacker infers whether the specified port is open on the target internal host, enabling network reconnaissance (Red Hat Bugzilla).

• Network: Outbound TCP connections from the GVfs client process to unexpected internal or external IP addresses and ports following an FTP session; PASV responses containing IP addresses that differ from the FTP server's control connection IP.
• Logs: System or application logs showing GVfs FTP backend connection attempts to private/internal IP ranges (e.g., RFC 1918 addresses) not associated with the FTP server; connection timeout or refused errors to unusual endpoints logged by the GVfs daemon.
• Process: The gvfsd-ftp daemon process initiating TCP connections to hosts or ports unrelated to the FTP server being accessed.

Patches have been issued by multiple Linux distributions. Users should update the gvfs package to the fixed version provided by their distribution: Ubuntu (USN-8114-1), SUSE (SUSE-SU-2026:0916-1, SUSE-SU-2026:0960-1), Debian (DLA-4513-1), Amazon Linux 2 (ALAS2-2026-3197), Slackware (SSA:2026-059-01), and openSUSE. FreeBSD users should update via the ports tree (freshports.org). No configuration-based workaround has been officially documented; upgrading to a patched gvfs version is the recommended remediation (Ubuntu Advisory, Debian Advisory, openSUSE Advisory).

Coverage of CVE-2026-28295 has been primarily technical and distribution-focused, with advisories issued by Red Hat, Ubuntu, SUSE, Debian, Slackware, and Amazon Linux. The German Linux news site Pro-Linux.de published multiple security notices covering the gvfs issues. No significant researcher commentary, vendor statements beyond patch advisories, or notable social media discussion has been identified (Red Hat CVE).