CVE-2026-28295
MEDIUM EPSS 8.4%
Published Feb 26, 20264mo ago · Modified Apr 15, 20262mo ago
4.3 CVSS 3.1
Published Feb 26, 2026 4mo ago
Last Modified Apr 15, 2026 2mo ago
Description
A flaw was found in the FTP GVfs backend. A malicious FTP server can exploit this vulnerability by providing an arbitrary IP address and port in its passive mode (PASV) response. The client unconditionally trusts this information and attempts to connect to the specified endpoint, allowing the malicious server to probe for open ports accessible from the client's network.
CVSS Details
Base Score
Exploitability
Impact
Vector string
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N Attack Vector Network
Attack Complexity Low
Privileges Required None
User Interaction Required
Scope Unchanged
Confidentiality Low
Integrity None
Availability None
Threat Intelligence
EPSS Exploit Probability
8.4% percentile
Exploit & Patch Status
No Known Exploit
No Patch Available
Weaknesses 1
CWE-918 Server-Side Request Forgery (SSRF) Validation
References 2
- access.redhat.com https://access.redhat.com/security/cve/CVE-2026-28295
- bugzilla.redhat.com https://bugzilla.redhat.com/show_bug.cgi?id=2443004
Remediation
No remediation data recorded yet
Check vendor advisories and the NVD entry for patch availability.