Bug#1129286: gvfs: CVE-2026-28296

[Salvatore Bonaccorso]

Source: gvfs
Version: 1.59.1-1
Severity: important
Tags: security upstream
Forwarded: https://gitlab.gnome.org/GNOME/gvfs/-/issues/833
X-Debbugs-Cc: carnil at debian.org, Debian Security Team <team at security.debian.org>
Control: found -1 1.57.2-2

Hi,

The following vulnerability was published for gvfs.

CVE-2026-28295[0]:
| A flaw was found in the FTP GVfs backend. A malicious FTP server can
| exploit this vulnerability by providing an arbitrary IP address and
| port in its passive mode (PASV) response. The client unconditionally
| trusts this information and attempts to connect to the specified
| endpoint, allowing the malicious server to probe for open ports
| accessible from the client's network.


If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2026-28295
    https://www.cve.org/CVERecord?id=CVE-2026-28295
[1] https://gitlab.gnome.org/GNOME/gvfs/-/issues/833

Please adjust the affected versions in the BTS as needed.

Regards,
Salvatore