A flaw in the FTP GVfs backend allows an attacker to inject arbitrary FTP commands by supplying file paths that contain carriage return and line feed sequences. The unsanitized CRLF characters terminate intended commands and start new ones, enabling an attacker to execute arbitrary FTP commands and potentially achieve code execution on the target system. This vulnerability is categorized as CWE-93, reflecting unsanitized input that can control network protocol commands.

Red Hat Enterprise Linux 6, 7, 8, 9, and 10 are affected when the GVfs FTP backend is present. No specific downstream package versions are listed, so all current installations of these operating systems carrying the default GVfs FTP support are vulnerable.

The CVSS score of 4.3 indicates moderate severity while the EPSS score of less than 1% suggests a very low likelihood of current exploitation. The vulnerability is not listed in the CISA KEV catalog. Based on the description, the attack vector is remote: an attacker can connect to the target’s FTP service or supply a crafted FTP URL to trigger the CRLF injection. The exploitation requires the ability to supply a file path to the FTP backend; once achieved, arbitrary FTP commands can be injected, potentially leading to code execution.