CVE-2026-44076 | THREATINT

Description

Insufficient sanitization of volume paths in Netatalk 3.1.0 through 4.4.2 allows a local privileged user to inject OS commands and execute arbitrary code via a crafted volume path.

PUBLISHED Reserved 2026-05-05 | Published 2026-05-21 | Updated 2026-05-22 | Assigner securin

MEDIUM: 6.7CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Problem types

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

Product status

Default status

unaffected

3.1.0 (semver)

affected

4.4.3 (semver)

unaffected

Credits

Arjun Basnet from Securin finder

References

netatalk.io/security/CVE-2026-44076 (Netatalk Security Advisory CVE-2026-44076) vendor-advisory

cve.org (CVE-2026-44076)

nvd.nist.gov (CVE-2026-44076)

Download JSON