Back Linuxsecurity Ubuntu 8114-1 GVfs Serious Remote Code Execution Vulnerability Alert
A security issue affects these releases of Ubuntu and its derivatives: - Ubuntu 25.10 - Ubuntu 24.04 LTS - Ubuntu 22.04 LTS Summary: Several security issues were fixed in GVfs. Software Description: - gvfs: Userspace virtual file system Details: It was discovered that the GVfs FTP backend incorrectly handled IP addresses and ports returned by passive mode responses. A malicious remote server could possibly use this issue to help scan for open ports. (CVE-2026-28295) It was discovered that the GVfs FTP backend incorrectly handled crafted file paths. A remote attacker could use this issue to terminate or inject arbitrary FTP commands, or possibly execute arbitrary code. (CVE-2026-28296)
A security issue affects these releases of Ubuntu and its derivatives: - Ubuntu 25.10 - Ubuntu 24.04 LTS - Ubuntu 22.04 LTS Summary: Several security issues were fixed in GVfs. Software Description: - gvfs: Userspace virtual file system Details: It was discovered that the GVfs FTP backend incorrectly handled IP addresses and ports returned by passive mode responses. A malicious remote server could possibly use this issue to help scan for open ports. (CVE-2026-28295) It was discovered that the GVfs FTP backend incorrectly handled crafted file paths. A remote attacker could use this issue to terminate or inject arbitrary FTP commands, or possibly execute arbitrary code. (CVE-2026-28296)
The problem can be corrected by updating your system to the following package versions: Ubuntu 25.10 gvfs 1.57.2-2ubuntu5.1 gvfs-backends 1.57.2-2ubuntu5.1 Ubuntu 24.04 LTS gvfs 1.54.4-0ubuntu1~24.04.2 gvfs-backends 1.54.4-0ubuntu1~24.04.2 Ubuntu 22.04 LTS gvfs 1.48.2-0ubuntu1.1 gvfs-backends 1.48.2-0ubuntu1.1 After a standard system update you need to restart your session to make all the necessary changes.
The problem can be corrected by updating your system to the following package versions: Ubuntu 25.10 gvfs 1.57.2-2ubuntu5.1 gvfs-backends 1.57.2-2ubuntu5.1 Ubuntu 24.04 LTS gvfs 1.54.4-0ubuntu1~24.04.2 gvfs-backends 1.54.4-0ubuntu1~24.04.2 Ubuntu 22.04 LTS gvfs 1.48.2-0ubuntu1.1 gvfs-backends 1.48.2-0ubuntu1.1 After a standard system update you need to restart your session to make all the necessary changes.
The full story
This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.
