Insufficient sanitization of volume paths in Netatalk 3.1.0 through 4.4.2 allows a local privileged user to inject OS commands and execute arbitrary… (CVE-2026-44076)

CVE-2026-44076 describes a vulnerability in Netatalk versions 3.1.0 through 4.4.2 where insufficient sanitization of volume paths allows a local privileged user to inject operating system commands and execute arbitrary code. This issue arises from improper handling of crafted volume paths, which can be exploited by users with elevated privileges to compromise system integrity and confidentiality. The vulnerability has a CVSS 3.1 score of 6.7, reflecting medium severity with high impact on confidentiality, integrity, and availability. The affected versions explicitly include multiple Ubuntu package versions of Netatalk 2.2.2 through 2.2.6. No patch or remediation information is provided in the source data.

A local user with privileged access can exploit this vulnerability to execute arbitrary OS commands, potentially leading to full system compromise. The impact affects confidentiality, integrity, and availability of the affected system. There are no reports of active exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict local privileged user access and avoid mounting or using untrusted volume paths. Monitor vendor channels for updates and apply patches promptly once released.