Skip to main content

Netatalk EUVDEUVD-2026-31230

| CVE-2026-44055 HIGH
OS Command Injection (CWE-78)
2026-05-21 securin GHSA-2jff-6g6p-wr79
Command Injection Suse
7.5
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
7.5 HIGH
AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
SUSE
HIGH
qualitative

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack Vector
Network
Attack Complexity
High
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

1
Analysis Generated
May 21, 2026 - 08:03 vuln.today

DescriptionCVE.org

In Netatalk 3.1.4 through 4.4.2, bitwise or logic bug enables shell injection. Fixed in 4.4.3.

AnalysisAI

Shell injection in Netatalk 3.1.4 through 4.4.2 allows authenticated remote attackers to execute arbitrary OS commands through a bitwise-OR logic flaw, achieving full confidentiality, integrity, and availability impact (CVSS 7.5). Netatalk is the open-source AFP (Apple Filing Protocol) server commonly deployed on Linux/BSD NAS appliances to share files with macOS clients. The flaw was fixed in version 4.4.3; no public exploit identified at time of analysis and the issue is not currently in CISA KEV.

Technical ContextAI

Netatalk implements Apple Filing Protocol services (afpd, cnid_metad) used to expose Unix file systems to macOS clients and is bundled into many commercial NAS firmwares (Synology, QNAP, etc.). The root cause is CWE-78 (Improper Neutralization of Special Elements used in an OS Command), introduced by a bitwise-OR logic error in code that constructs or evaluates a command string. Per the vendor advisory at netatalk.io/security/CVE-2026-44055 the defect chain leads to attacker-controlled input being passed unsanitized into a shell context, enabling arbitrary command execution within whichever process spawned the shell. The affected CPE is cpe:2.3:a:netatalk:netatalk:*:*:*:*:*:*:*:* across the 3.1.4-4.4.2 range.

RemediationAI

Upgrade to Netatalk 4.4.3 or later, which contains the upstream fix per the vendor advisory at https://netatalk.io/security/CVE-2026-44055 (Vendor-released patch: 4.4.3). For appliances where the user cannot replace the bundled binary directly, monitor the NAS vendor's security feed for a firmware update incorporating 4.4.3 and apply it as soon as released. Until patched, compensating controls include restricting afpd network exposure to trusted management VLANs via host firewall rules on TCP/548, disabling the AFP service entirely on hosts where SMB can substitute (note: this breaks Time Machine over AFP and legacy macOS client compatibility), and tightening authentication so that the PR:L precondition cannot be satisfied by anonymous/guest accounts (review uams configuration and disable uams_guest.so if enabled).

Same weakness CWE-78 – OS Command Injection

View all
CVE-2014-6271 CRITICAL POC
9.8
CVE-2014-6278 HIGH POC
8.8
CVE-2017-6334 HIGH POC
8.8
CVE-2024-50603 CRITICAL POC
10.0
CVE-2025-64328 HIGH POC
8.6
CVE-2014-7169 CRITICAL POC
9.8
CVE-2017-6884 HIGH POC
8.8
CVE-2017-6077 CRITICAL POC
9.8

Same technique Command Injection

View all
CVE-2012-1823 CRITICAL POC
9.8
CVE-2016-1555 CRITICAL POC
9.8
CVE-2014-6271 CRITICAL POC
9.8
CVE-2015-2051 HIGH POC
8.8
CVE-2014-6278 HIGH POC
8.8
CVE-2017-6334 HIGH POC
8.8
CVE-2024-50603 CRITICAL POC
10.0
CVE-2025-64328 HIGH POC
8.6

Vendor StatusVendor

SUSE

Severity: High
Product Status
SUSE Linux Enterprise Server 12 SP5 Fixed
SUSE Linux Enterprise Server 12 SP5-LTSS Fixed
SUSE Linux Enterprise Server 12 SP5-LTSS Extended Security Fixed
SUSE Linux Enterprise Server for SAP Applications 12 SP5 Fixed
SUSE Linux Enterprise Desktop 12 Fixed

Share

EUVD-2026-31230 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy