CVE-2026-28296

MEDIUM EPSS 27.9%

Published Feb 26, 20264mo ago · Modified Apr 15, 20262mo ago

4.3 CVSS 3.1

Medium

Published Feb 26, 2026 4mo ago

Last Modified Apr 15, 2026 2mo ago

Description

A flaw was found in the FTP GVfs backend. A remote attacker could exploit this input validation vulnerability by supplying specially crafted file paths containing carriage return and line feed (CRLF) sequences. These unsanitized sequences allow the attacker to terminate intended FTP commands and inject arbitrary FTP commands, potentially leading to arbitrary code execution or other severe impacts.

CVSS Details

Base Score

4.3

Exploitability

2.8

Impact

1.4

Vector string

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

Attack Vector Network

Attack Complexity Low

Privileges Required None

User Interaction Required

Scope Unchanged

Confidentiality Low

Integrity None

Availability None

Threat Intelligence

EPSS Exploit Probability

27.9% percentile

Exploit & Patch Status

No Known Exploit

No Patch Available

Weaknesses 1

CWE-93

References 2

access.redhat.com https://access.redhat.com/security/cve/CVE-2026-28296
bugzilla.redhat.com https://bugzilla.redhat.com/show_bug.cgi?id=2443003

Remediation

No remediation data recorded yet

Check vendor advisories and the NVD entry for patch availability.