The FTP GVfs backend in daemon/gvfsftptask.c:868-907 unconditionally trusts the IP address and port returned in PASV responses from FTP servers. When handling passive mode data transfers, the code parses the server's PASV reply and directly constructs a GInetSocketAddress without validating that the advertised IP matches the control connection or restricting private/internal addresses. The client then connects to this arbitrary endpoint via g_vfs_ftp_connection_open_data_connection().
This allows an attacker (the malicious server) to probe the existence of open ports accessible to the client.