Netatalk CVE-2026-44051

Requires an authenticated AFP session against a Netatalk daemon running 3.0.2 through 4.4.2 with write access to at least one share so the attacker can place a symbolic link, plus the ability to subsequently request that symlink over the same AFP connection - the CVSS PR:L confirms low-privileged credentials are needed and exploitation is not possible against fully anonymous deployments or read-only shares. Exploitation is limited where AFP is firewalled to trusted management networks, where shares are mounted read-only, or where the OS-level account used by netatalk has minimal filesystem read rights, since the daemon can only return files its own process can read.

The CVSS 3.1 base score of 8.1 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N) reflects network reach, low attack complexity, and only low-privilege authentication, with high impact on both confidentiality and integrity. However, the description language frames this strictly as 'arbitrary file read' (information disclosure), which conflicts with the I:H rating in the vector - defenders should treat the realistic primary impact as confidentiality compromise unless the integrity claim is validated against the vendor advisory. The vulnerability is not on the CISA KEV list, no EPSS score or SSVC decision was supplied with this input, and no public exploit identified at time of analysis, so this is best treated as an urgent patch-cycle item rather than an active incident - particularly for Netatalk instances exposed beyond trusted LANs.

An attacker with valid AFP credentials (for example, a low-privileged user on a NAS or workgroup file server) connects to the Netatalk share and creates a symlink inside their writable directory that points to a sensitive server-side path such as /etc/shadow or a configuration file containing secrets. They then request that symlink over AFP and the server returns the target file's contents, yielding credentials or keys that enable further lateral movement; no public exploit identified at time of analysis but the steps are straightforward to reproduce.