The FTP GVfs backend fails to sanitize CRLF sequences in user supplied file paths before constructing FTP protocol commands. When g_vfs_ftp_file_new_from_gvfs() creates a file object in daemon/gvfsftpfile.c:77-87, it copies the path without validation. This unsanitized path flows through g_vfs_ftp_file_get_ftp_path() into command format strings like "RETR %s" at daemon/gvfsbackendftp.c:883. In daemon/gvfsftptask.c:661, g_string_append_vprintf() includes the malicious path directly into the command buffer, allowing embedded \r\n sequences to terminate the intended command and inject arbitrary FTP commands.