CVE-2026-28296

{"id": "CVE-2026-28296", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "secalert@redhat.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 1.4, "exploitabilityScore": 2.8}]}, "published": "2026-02-26T16:24:09.580", "references": [{"url": "https://access.redhat.com/security/cve/CVE-2026-28296", "source": "secalert@redhat.com"}, {"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2443003", "source": "secalert@redhat.com"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Primary", "source": "secalert@redhat.com", "description": [{"lang": "en", "value": "CWE-93"}]}], "descriptions": [{"lang": "en", "value": "A flaw was found in the FTP GVfs backend. A remote attacker could exploit this input validation vulnerability by supplying specially crafted file paths containing carriage return and line feed (CRLF) sequences. These unsanitized sequences allow the attacker to terminate intended FTP commands and inject arbitrary FTP commands, potentially leading to arbitrary code execution or other severe impacts."}, {"lang": "es", "value": "Se encontr\u00f3 una falla en el backend FTP de GVfs. Un atacante remoto podr\u00eda explotar esta vulnerabilidad de validaci\u00f3n de entrada al proporcionar rutas de archivo especialmente dise\u00f1adas que contienen secuencias de retorno de carro y salto de l\u00ednea (CRLF). Estas secuencias no saneadas permiten al atacante terminar comandos FTP previstos e inyectar comandos FTP arbitrarios, lo que podr\u00eda llevar a la ejecuci\u00f3n de c\u00f3digo arbitrario u otros impactos graves."}], "lastModified": "2026-04-15T00:35:42.020", "sourceIdentifier": "secalert@redhat.com"}