CVE-2026-44072 PUBLISHED

system() after failed chdir()

Assigner: securin
Reserved: 05.05.2026 Published: 21.05.2026 Updated: 21.05.2026

Netatalk 2.2.1 through 4.4.2 calls system() after a failed chdir() without properly handling the error condition, which allows a local privileged user to execute unintended commands or cause a minor service disruption under specific conditions.

Metrics

CVSS 3.1

CVSS Vector: CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:L/A:L
CVSS Score: 2.5

Attack Vector	Local	Scope	Unchanged
Attack Complexity	High	Confidentiality Impact	None
Privileges Required	High	Integrity Impact	Low
User Interaction	None	Availability Impact	Low

CVSS 3.1

Product Status

Vendor	Netatalk
Product	Netatalk
Versions	Default: unaffected affected from 2.2.1 to 4.4.2 (incl.) Version 4.5.0 is unaffected

Credits

Arjun Basnet from Securin finder

References

Netatalk Security Advisory CVE-2026-44072

Problem Types

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') CWE