Netatalk CVE-2026-44068

Attacker must reach TCP/548 (AFP) on a host running Netatalk between 2.1.0 and 4.4.2 inclusive, hold valid AFP credentials at low privilege (CVSS PR:L - guest or a normal share user is sufficient; fully unauthenticated abuse is not indicated by the vector), and be able to invoke the extended-attribute (ea) code path on a mounted share. Exploitation is limited by: AFP being disabled or firewalled (many modern deployments default to SMB), shares configured without guest access and without the vulnerable user holding any account, and per-share ea support being turned off. No user interaction on the victim side is required (UI:N), and scope is unchanged (S:U), so impact is confined to files reachable by the netatalk service account on the same host.

Signals are moderate and broadly consistent: CVSS 7.6 with AV:N/AC:L/PR:L/UI:N indicates a network-reachable, low-complexity bug requiring some level of authentication, with high integrity impact and low confidentiality/availability impact - matching a write-capable path traversal rather than full RCE. The bug is not present in CISA KEV and no POC has been published, so there is no evidence of active exploitation; EPSS data was not supplied in the input. The real-world risk is elevated by Netatalk's wide deployment on NAS firmware where AFP shares often face internal networks with weak guest/low-privilege accounts, and where vendor firmware updates lag upstream releases. Conflicting/missing signals to note: the description does not state whether 'ea' here means the AFP extended-attribute RPC or on-disk EA storage, and no independent confirmation of the 4.4.3 fix beyond the vendor advisory is available - so exploitation primitive specifics (read vs write, scope of traversal) should be verified against the netatalk.io advisory before tuning detections.

An internal attacker with valid low-privilege AFP credentials on a Netatalk-backed NAS (for example, a guest or shared backup account) opens an AFP session and issues extended-attribute operations whose path components contain traversal sequences that survive Netatalk's incomplete sanitizer. The server resolves the manipulated ea path outside the share root, allowing the attacker to write or alter sensitive files such as other users' Time Machine backups, configuration files, or SSH key material owned by the Netatalk service account. No public exploit identified at time of analysis.