A flaw in the GVfs FTP backend allows a malicious FTP server to provide an arbitrary IP address and port in its passive mode (PASV) response. The client unconditionally trusts this information and attempts to connect to the specified endpoint, enabling the server to probe for and discover open ports accessible from the client’s network. The attacker therefore obtains information about the client’s external connectivity and possible services, leading to an information disclosure risk.

This vulnerability affects Red Hat Enterprise Linux distributions 10, 6, 7, 8, and 9. No further version granularity is provided, so all installations of these series that include the GVfs FTP backend are potentially impacted.

The CVSS score of 4.3 indicates a moderate risk, and the EPSS score of less than 1% shows a very low probability of exploitation. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires the client to connect to an attacker‑controlled FTP server, so the attack vector is client‑initiated and relies on the user establishing a connection to an untrusted server.