CVE-2026-28296

Gvfs is a userspace virtual filesystem implementation for GIO (a library available in GLib). It comes with a set of backends, including trash support, SFTP, SMB, HTTP, DAV, and many others. Gvfs also contains modules for GIO that implement volume monitors and persistent metadata storage.

Security Fix(es):

A flaw was found in the FTP GVfs backend. A remote attacker could exploit this input validation vulnerability by supplying specially crafted file paths containing carriage return and line feed (CRLF) sequences. These unsanitized sequences allow the attacker to terminate intended FTP commands and inject arbitrary FTP commands, potentially leading to arbitrary code execution or other severe impacts.(CVE-2026-28296)

Gvfs is a userspace virtual filesystem implementation for GIO (a library available in GLib). It comes with a set of backends, including trash support, SFTP, SMB, HTTP, DAV, and many others. Gvfs also contains modules for GIO that implement volume monitors and persistent metadata storage.

Security Fix(es):

A flaw was found in the FTP GVfs backend. A malicious FTP server can exploit this vulnerability by providing an arbitrary IP address and port in its passive mode (PASV) response. The client unconditionally trusts this information and attempts to connect to the specified endpoint, allowing the malicious server to probe for open ports accessible from the client's network.(CVE-2026-28295)

A flaw was found in the FTP GVfs backend. A remote attacker could exploit this input validation vulnerability by supplying specially crafted file paths containing carriage return and line feed (CRLF) sequences. These unsanitized sequences allow the attacker to terminate intended FTP commands and inject arbitrary FTP commands, potentially leading to arbitrary code execution or other severe impacts.(CVE-2026-28296)

Gvfs is a userspace virtual filesystem implementation for GIO (a library available in GLib). It comes with a set of backends, including trash support, SFTP, SMB, HTTP, DAV, and many others. Gvfs also contains modules for GIO that implement volume monitors and persistent metadata storage.

Security Fix(es):

A flaw was found in the FTP GVfs backend. A remote attacker could exploit this input validation vulnerability by supplying specially crafted file paths containing carriage return and line feed (CRLF) sequences. These unsanitized sequences allow the attacker to terminate intended FTP commands and inject arbitrary FTP commands, potentially leading to arbitrary code execution or other severe impacts.(CVE-2026-28296)

A flaw was found in the FTP GVfs backend. A remote attacker could exploit this input validation vulnerability by supplying specially crafted file paths containing carriage return and line feed (CRLF) sequences. These unsanitized sequences allow the attacker to terminate intended FTP commands and inject arbitrary FTP commands, potentially leading to arbitrary code execution or other severe impacts.

Gvfs: gvfs ftp backend: information disclosure via untrusted pasv responses. (CVE-2026-28295) Gvfs: ftp gvfs backend: arbitrary ftp command injection via crlf sequences in file paths. (CVE-2026-28296)

These are all security issues fixed in the gvfs-1.58.2-1.1 package on the GA media of openSUSE Tumbleweed.

This update for gnome-online-accounts, gvfs fixes the following issues:

Changes for gvfs:

Update gvfs to 1.59.90:

• CVE-2026-28295: information disclosure when processing untrusted PASV responses from FTP servers (bsc#1258953).
• CVE-2026-28296: arbitrary FTP command injection due to unsanitized CRLF sequences in user supplied file paths (bsc#1258954).

Changelog:

Update to version 1.59.90:

• client: Fix use-after-free when creating async proxy failed
• udisks2: Emit changed signals from update_all()
• daemon: Fix race on subscribers list when on thread
• ftp: Validate fe_size when parsing symlink target
• ftp: Check localtime() return value before use
• gphoto2: Use g_try_realloc() instead of g_realloc()
• cdda: Reject path traversal in mount URI host
• client: Fail when URI has invalid UTF-8 chars
• udisks2: Fix memory corruption with duplicate mount paths
• build: Update GOA dependency to > 3.57.0
• Some other fixes
• ftp: Use control connection address for PASV data.
• ftp: Reject paths containing CR/LF characters

Update to version 1.59.1:

• mtp: replace Android extension checks with capability checks
• dav: Add X-OC-Mtime header on push to preserve last modified time
• udisks2: Use hash tables in the volume monitor to improve performance
• onedrive: Check for identity instead of presentation identity
• build: Disable google option and mark as deprecated

Update to version 1.58.2:

• ftp: Use control connection address for PASV data
• ftp: Reject paths containing CR/LF characters

Update to version 1.58.1:

• cdda: Fix duration of last track for some media
• build: Fix build when google option is disabled
• Fix various memory leaks
• Updated translations.

Update to version 1.58.0:

• mtp: Allow cancelling ongoing folder enumerations
• wsdd: Use socket-activated service if available
• onedrive: Set emblem for remote data
• fix: Add file rename support in MTP backend move operation
• mtp: Fix -Wmaybe-uninitialized warning in pad_file
• fuse: use fuse_(un)set_feature_flag for libfuse 3.17+
• smbbrowse: Purge server cache for next auth try
• metatree: Open files with O_CLOEXEC
• cdda: Fix incorrect track duration for 99-track CDs
• metadata: Fix journal file permissions inconsistency
• dav: recognize 308 Permanent Redirect

Changes for gnome-online-accounts:

Update to version 3.58.0:

• SMTP server without password cannot be configured
• Remove unneeded SMTP password escaping
• build: Disable google provider Files feature
• MS365: Fix mail address and name
• Google: Set mail name to presentation identity
• Updated translations.

Update to version 3.57.1:

• Default Microsoft 365 client is unverified
• Microsoft 365: Make use of email for id
• goadaemon: Allow manage system notifications
• goamsgraphprovider: bump credentials generation
• goaprovider: Allow to disable, instead of enable, selected providers

Changes from version 3.57.0:

• Support for saving a Kerberos password to the keychain after the first login
• changing expired kerberos password is not supported.
• Provided Files URI does not override undiscovered endpoint
• DAV client rejects 204 status in OPTIONS request handler
• Include emblem-default-symbolic.svg
• Connecting a Runbox CardDAV/CalDAV account hangs/freezes after sign in
• i81n: fix translatable string
• goaimapsmptprovider: fix accounts without SMTP or authentication-less SMTP
• build: only install icons for the goabackend build
• build: don't require goabackend to build documentation
• ci: test the build without gtk4
• DAV-client: Added short path for SOGo

Update to version 3.56.4:

• Bugs fixed:

• Unclear which part of "IMAP+SMTP" account test failed
• Adding nextcloud account which has a subfolder does not work
• goadaemon: Handle broken account configs

Update to version 3.56.3:

• Add DAV detection and configuration for SOGo
• DAV discovery fails when certain SRV lookups fail

Update to version 3.56.1:

-…

This update for gvfs fixes the following issues:

• CVE-2026-28295: fixed by using control connection address for PASV data (bsc#1258953).
• CVE-2026-28296: fixed by rejecting paths containing CR/LF characters (bsc#1258954).

This update for gvfs fixes the following issues:

• CVE-2026-28295: Fix ftp use control connection address for PASV data (bsc#1258953).
• CVE-2026-28296: Fix ftp reject paths containing CR/LF characters (bsc#1258954).

This update for gvfs fixes the following issues:

• CVE-2026-28295: information disclosure when processing untrusted PASV responses from FTP servers (bsc#1258953).
• CVE-2026-28296: arbitrary FTP command injection due to unsanitized CRLF sequences in user supplied file paths (bsc#1258954).

This update for gnome-online-accounts, gvfs fixes the following issues:

Changes for gvfs:

Update gvfs to 1.59.90:

• CVE-2026-28295: information disclosure when processing untrusted PASV responses from FTP servers (bsc#1258953).
• CVE-2026-28296: arbitrary FTP command injection due to unsanitized CRLF sequences in user supplied file paths (bsc#1258954).

Changelog:

Update to version 1.59.90:

• client: Fix use-after-free when creating async proxy failed
• udisks2: Emit changed signals from update_all()
• daemon: Fix race on subscribers list when on thread
• ftp: Validate fe_size when parsing symlink target
• ftp: Check localtime() return value before use
• gphoto2: Use g_try_realloc() instead of g_realloc()
• cdda: Reject path traversal in mount URI host
• client: Fail when URI has invalid UTF-8 chars
• udisks2: Fix memory corruption with duplicate mount paths
• build: Update GOA dependency to > 3.57.0
• Some other fixes
• ftp: Use control connection address for PASV data.
• ftp: Reject paths containing CR/LF characters

Update to version 1.59.1:

• mtp: replace Android extension checks with capability checks
• dav: Add X-OC-Mtime header on push to preserve last modified time
• udisks2: Use hash tables in the volume monitor to improve performance
• onedrive: Check for identity instead of presentation identity
• build: Disable google option and mark as deprecated

Update to version 1.58.2:

• ftp: Use control connection address for PASV data
• ftp: Reject paths containing CR/LF characters

Update to version 1.58.1:

• cdda: Fix duration of last track for some media
• build: Fix build when google option is disabled
• Fix various memory leaks
• Updated translations.

Update to version 1.58.0:

• mtp: Allow cancelling ongoing folder enumerations
• wsdd: Use socket-activated service if available
• onedrive: Set emblem for remote data
• fix: Add file rename support in MTP backend move operation
• mtp: Fix -Wmaybe-uninitialized warning in pad_file
• fuse: use fuse_(un)set_feature_flag for libfuse 3.17+
• smbbrowse: Purge server cache for next auth try
• metatree: Open files with O_CLOEXEC
• cdda: Fix incorrect track duration for 99-track CDs
• metadata: Fix journal file permissions inconsistency
• dav: recognize 308 Permanent Redirect

Changes for gnome-online-accounts:

Update to version 3.58.0:

• SMTP server without password cannot be configured
• Remove unneeded SMTP password escaping
• build: Disable google provider Files feature
• MS365: Fix mail address and name
• Google: Set mail name to presentation identity
• Updated translations.

Update to version 3.57.1:

• Default Microsoft 365 client is unverified
• Microsoft 365: Make use of email for id
• goadaemon: Allow manage system notifications
• goamsgraphprovider: bump credentials generation
• goaprovider: Allow to disable, instead of enable, selected providers

Changes from version 3.57.0:

• Support for saving a Kerberos password to the keychain after the first login
• changing expired kerberos password is not supported.
• Provided Files URI does not override undiscovered endpoint
• DAV client rejects 204 status in OPTIONS request handler
• Include emblem-default-symbolic.svg
• Connecting a Runbox CardDAV/CalDAV account hangs/freezes after sign in
• i81n: fix translatable string
• goaimapsmptprovider: fix accounts without SMTP or authentication-less SMTP
• build: only install icons for the goabackend build
• build: don't require goabackend to build documentation
• ci: test the build without gtk4
• DAV-client: Added short path for SOGo

Update to version 3.56.4:

• Bugs fixed:

• Unclear which part of "IMAP+SMTP" account test failed
• Adding nextcloud account which has a subfolder does not work
• goadaemon: Handle broken account configs

Update to version 3.56.3:

• Add DAV detection and configuration for SOGo
• DAV discovery fails when certain SRV lookups fail

Update to version 3.56.1:

-…

It was discovered that the GVfs FTP backend incorrectly handled IP addresses and ports returned by passive mode responses. A malicious remote server could possibly use this issue to help scan for open ports. (CVE-2026-28295)

It was discovered that the GVfs FTP backend incorrectly handled crafted file paths. A remote attacker could use this issue to terminate or inject arbitrary FTP commands, or possibly execute arbitrary code. (CVE-2026-28296)