A flaw was found in the FTP GVfs backend. A malicious FTP server can exploit this vulnerability by providing an arbitrary IP address and port in its passive mode (PASV) response. The client unconditionally trusts this information and attempts to connect to the specified endpoint, allowing the malicious server to probe for open ports accessible from the client's network.

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:20451-1 advisory.

    Changes for gvfs:

    Update gvfs to 1.59.90:

    - CVE-2026-28295: information disclosure when processing untrusted PASV responses from FTP servers     (bsc#1258953).
    - CVE-2026-28296: arbitrary FTP command injection due to unsanitized CRLF sequences in user supplied file     paths       (bsc#1258954).

    Changelog:

    Update to version 1.59.90:

     - client: Fix use-after-free when creating async proxy failed      + udisks2: Emit changed signals from update_all()      + daemon: Fix race on subscribers list when on thread      + ftp: Validate fe_size when parsing symlink target      + ftp: Check localtime() return value before use      + gphoto2: Use g_try_realloc() instead of g_realloc()      + cdda: Reject path traversal in mount URI host      + client: Fail when URI has invalid UTF-8 chars      + udisks2: Fix memory corruption with duplicate mount paths      + build: Update GOA dependency to > 3.57.0      + Some other fixes      + ftp: Use control connection address for PASV data.
     + ftp: Reject paths containing CR/LF characters

    Update to version 1.59.1:

     - mtp: replace Android extension checks with capability checks      + dav: Add X-OC-Mtime header on push to preserve last modified      time      + udisks2: Use hash tables in the volume monitor to improve      performance      + onedrive: Check for identity instead of presentation identity      + build: Disable google option and mark as deprecated

    Update to version 1.58.2:

     - ftp: Use control connection address for PASV data      + ftp: Reject paths containing CR/LF characters

    Update to version 1.58.1:

     - cdda: Fix duration of last track for some media      + build: Fix build when google option is disabled      + Fix various memory leaks      + Updated translations.

    Update to version 1.58.0:

     - mtp: Allow cancelling ongoing folder enumerations      + wsdd: Use socket-activated service if available      + onedrive: Set emblem for remote data      + fix: Add file rename support in MTP backend move operation      + mtp: Fix -Wmaybe-uninitialized warning in pad_file      + fuse: use fuse_(un)set_feature_flag for libfuse 3.17+      + smbbrowse: Purge server cache for next auth try      + metatree: Open files with O_CLOEXEC      + cdda: Fix incorrect track duration for 99-track CDs      + metadata: Fix journal file permissions inconsistency      + dav: recognize 308 Permanent Redirect

    Changes for gnome-online-accounts:

    Update to version 3.58.0:

     - SMTP server without password cannot be configured      + Remove unneeded SMTP password escaping      + build: Disable google provider Files feature      + MS365: Fix mail address and name      + Google: Set mail name to presentation identity      + Updated translations.

    Update to version 3.57.1:

     - Default Microsoft 365 client is unverified      + Microsoft 365: Make use of email for id      + goadaemon: Allow manage system notifications      + goamsgraphprovider: bump credentials generation      + goaprovider: Allow to disable, instead of enable, selected        providers

    Changes from version 3.57.0:

     - Support for saving a Kerberos password to the keychain after      the first login      + changing expired kerberos password is not supported.
     + Provided Files URI does not override undiscovered endpoint      + DAV client rejects 204 status in OPTIONS request handler      + Include emblem-default-symbolic.svg      + Connecting a Runbox CardDAV/CalDAV account hangs/freezes after      sign in      + i81n: fix translatable string      + goaimapsmptprovider: fix accounts without SMTP or        authentication-less SMTP      + build: only install icons for the goabackend build      + build: don't require goabackend to build documentation      + ci: test the build without gtk4      + DAV-client: Added short path for SOGo

    Update to version 3.56.4:

     - Bugs fixed:
     - Unclear which part of IMAP+SMTP account test failed
     - Adding nextcloud account which has a subfolder does not work
     - goadaemon: Handle broken account configs

    Update to version 3.56.3:

     - Add DAV detection and configuration for SOGo
     - DAV discovery fails when certain SRV lookups fail

    Update to version 3.56.1:

     - Support for saving a Kerberos password after the first login
     - Changing expired kerberos password is not supported
     - Provided Files URI does not override undiscovered endpoint
     - DAV client rejects 204 status in OPTIONS request handler

    Update to version 3.56.0:

     - Code style and logging cleanups      + Updated translations

    Update to version 3.55.2:

     - goaoauth2provider: improve error handling for auth/token        endpoints

    Update to version 3.55.1:

     - Support Webflow authentication for Nextcloud
     - Rename dconf key in gnome-online-accounts settings
     - Account Name GUI field is a bit ambiguous
     - Failed to generate a new POT file for the user interface of        gnome-online-accounts (domain: po) and some missing files         from POTFILES.in

    Update to version 3.55.0:

     - Add progress spinner for OAuth2 dialogs
     - Remove Windows Live! option
     - Improve goa_oauth2_provider_ensure_credentials_sync
     - Authentication failure in goa IMAP accounts
     - Missing files from POTFILES.in
     - WebDAV not detected for mail.ru
     - goaoauth2provider: fix task chaining for subclasses
     - Always lowercase domains when looking up base
     - goadavclient: check Nextcloud fallback last
     - goabackend: add a composite widget for authflow links
     - goadavclient: fix the mailbox.org preconfig

    Update to version 3.54.5:

     - Adding GOA account fails with sonic.net IMAP service
     - Cannot add a ProtonMail bridge with IMAP + TLS
     - Nextcloud login does not work anymore due to OPTIONS /login        request
     - Linked online accounts no longer work
     - Invalid URI when adding Google account
     - goamsgraphprovider: ensure a valid PresentationIdentity
     - goadaemon: complete GTasks to avoid a scary debug warning

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-1475 advisory.

    A flaw was found in the FTP GVfs backend. A malicious FTP server can exploit this vulnerability by     providing an arbitrary IP address and port in its passive mode (PASV) response. The client unconditionally     trusts this information and attempts to connect to the specified endpoint, allowing the malicious server     to probe for open ports accessible from the client's network. (CVE-2026-28295)

    A flaw was found in the FTP GVfs backend. A remote attacker could exploit this input validation     vulnerability by supplying specially crafted file paths containing carriage return and line feed (CRLF)     sequences. These unsanitized sequences allow the attacker to terminate intended FTP commands and inject     arbitrary FTP commands, potentially leading to arbitrary code execution or other severe impacts.
    (CVE-2026-28296)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 11 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-4513 advisory.

    -------------------------------------------------------------------------     Debian LTS Advisory DLA-4513-1                debian-lts@lists.debian.org     https://www.debian.org/lts/security/                   Andreas Henriksson     March 28, 2026                                https://wiki.debian.org/LTS
    -------------------------------------------------------------------------

    Package        : gvfs     Version        : 1.46.2-2+deb11u1     CVE ID         : CVE-2026-28295 CVE-2026-28296     Debian Bug     : 1129285 1129286

    Codean Labs found that gvfs, a virtual filesystem implementation, was     affected by multiple vulnerabililies including FTP bounce attack     which could lead to probing open ports on client network and     improper CRLF validation which could allow an attacker to inject arbitrary FTP     commands.

    CVE-2026-28295

        A malicious FTP server can exploit this vulnerability by providing an         arbitrary IP address and port in its passive mode (PASV) response. The         client unconditionally trusts this information and attempts to connect to         the specified endpoint, allowing the malicious server to probe for open         ports accessible from the client's network.

    CVE-2026-28296

        A remote attacker could exploit this input validation vulnerability by         supplying specially crafted file paths containing carriage return and line         feed (CRLF) sequences. These unsanitized sequences allow the attacker to         terminate intended FTP commands and inject arbitrary FTP commands,         potentially leading to arbitrary code execution or other severe impacts.

    For Debian 11 bullseye, these problems have been fixed in version     1.46.2-2+deb11u1.

    We recommend that you upgrade your gvfs packages.

    For the detailed security status of gvfs please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/gvfs

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS     Attachment:
    signature.asc     Description: PGP signature

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 22.04 LTS / 24.04 LTS / 25.10 host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-8114-1 advisory.

    It was discovered that the GVfs FTP backend incorrectly handled IP addresses and ports returned by passive     mode responses. A malicious remote server could possibly use this issue to help scan for open ports.
    (CVE-2026-28295)

    It was discovered that the GVfs FTP backend incorrectly handled crafted file paths. A remote attacker     could use this issue to terminate or inject arbitrary FTP commands, or possibly execute arbitrary code.
    (CVE-2026-28296)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:0960-1 advisory.

    - CVE-2026-28295: information disclosure when processing untrusted PASV responses from FTP servers     (bsc#1258953).
    - CVE-2026-28296: arbitrary FTP command injection due to unsanitized CRLF sequences in user supplied file     paths       (bsc#1258954).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of gvfs installed on the remote host is prior to 1.36.2-3. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2026-3197 advisory.

    A flaw was found in the FTP GVfs backend. A malicious FTP server can exploit this vulnerability by     providing an arbitrary IP address and port in its passive mode (PASV) response. The client unconditionally     trusts this information and attempts to connect to the specified endpoint, allowing the malicious server     to probe for open ports accessible from the client's network. (CVE-2026-28295)

    A flaw was found in the FTP GVfs backend. A remote attacker could exploit this input validation     vulnerability by supplying specially crafted file paths containing carriage return and line feed (CRLF)     sequences. These unsanitized sequences allow the attacker to terminate intended FTP commands and inject     arbitrary FTP commands, potentially leading to arbitrary code execution or other severe impacts.
    (CVE-2026-28296)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:0916-1 advisory.

    - CVE-2026-28295: fixed by using control connection address for PASV data (bsc#1258953).
    - CVE-2026-28296: fixed by rejecting paths containing CR/LF characters (bsc#1258954).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:0923-1 advisory.

    - CVE-2026-28295: Fix ftp use control connection address for PASV data (bsc#1258953).
    - CVE-2026-28296: Fix ftp reject paths containing CR/LF characters (bsc#1258954).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of gvfs installed on the remote host is prior to 1.48.1 / 1.58.2. It is, therefore, affected by multiple vulnerabilities as referenced in the SSA:2026-059-01 advisory.

    New gvfs packages are available for Slackware 15.0 and -current to fix security issues.

Tenable has extracted the preceding description block directly from the gvfs security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - A flaw was found in the FTP GVfs backend. A malicious FTP server can exploit this vulnerability by     providing an arbitrary IP address and port in its passive mode (PASV) response. The client unconditionally     trusts this information and attempts to connect to the specified endpoint, allowing the malicious server     to probe for open ports accessible from the client's network. (CVE-2026-28295)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Severity
304864	openSUSE 16 Security Update : gnome-online-accounts, gvfs (openSUSE-SU-2026:20451-1)	Nessus	SuSE Local Security Checks	medium
304271	Amazon Linux 2023 : gvfs, gvfs-archive, gvfs-client (ALAS2023-2026-1475)	Nessus	Amazon Linux Local Security Checks	medium
304178	Debian dla-4513 : gvfs - security update	Nessus	Debian Local Security Checks	medium
303748	Ubuntu 22.04 LTS / 24.04 LTS / 25.10 : GVfs vulnerabilities (USN-8114-1)	Nessus	Ubuntu Local Security Checks	medium
303402	SUSE SLED15 / SLES15 / openSUSE 15 Security Update : gvfs (SUSE-SU-2026:0960-1)	Nessus	SuSE Local Security Checks	medium
303102	Amazon Linux 2 : gvfs, --advisory ALAS2-2026-3197 (ALAS-2026-3197)	Nessus	Amazon Linux Local Security Checks	medium
303011	SUSE SLES12 Security Update : gvfs (SUSE-SU-2026:0916-1)	Nessus	SuSE Local Security Checks	medium
302998	SUSE SLES15 Security Update : gvfs (SUSE-SU-2026:0923-1)	Nessus	SuSE Local Security Checks	medium
300551	Slackware Linux 15.0 / current gvfs Multiple Vulnerabilities (SSA:2026-059-01)	Nessus	Slackware Local Security Checks	medium
300158	Linux Distros Unpatched Vulnerability : CVE-2026-28295	Nessus	Misc.	medium

Detections

Analytics

CVE-2026-28295

medium

Tenable Plugins

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium