CVE-2026-44076

MediumCVSS 6.7

Published: 21/05/2026(UTC)Updated: 23/07/2026(UTC)Translated: 25/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.13%

3th percentile - higher than 3% of all known CVEs

Summary

Insufficient sanitization of volume paths in Netatalk 3.1.0 through 4.4.2 allows a local privileged user to inject OS commands and execute arbitrary code via a crafted volume path.

Risk Assessment

A local administrator or privileged user can take control of the file server by executing arbitrary system commands.

Recommendation

Update Netatalk to version 4.4.3 or later, which includes a fix for this vulnerability.

Original NVD description (English source)

Insufficient sanitization of volume paths in Netatalk 3.1.0 through 4.4.2 allows a local privileged user to inject OS commands and execute arbitrary code via a crafted volume path.