CVE Catalog
CVE-2026-44072
LowCVSS 3.0Exploitation Probability (EPSS)
Low risk0.09%
1th percentile - higher than 1% of all known CVEs
Summary
Vulnerability in Netatalk versions 2.2.1 through 4.4.2. The system() function is called after a failed chdir() without proper error handling, allowing a local privileged user to execute unintended commands or cause minor service disruption.
Risk Assessment
Risk includes local privilege escalation, potentially leading to arbitrary command execution or service disruption.
Recommendation
Upgrade Netatalk to version 4.4.3 or later, which includes a fix for this issue.
Original NVD description (English source)
Netatalk 2.2.1 through 4.4.2 calls system() after a failed chdir() without properly handling the error condition, which allows a local privileged user to execute unintended commands or cause a minor service disruption under specific conditions.