VulnerabilityDeferred

CVE-2026-44076

Insufficient sanitization of volume paths in Netatalk 3.1.0 through 4.4.2 allows a local privileged user to inject OS commands and execute arbitrary code via a crafted volume path.

MEDIUM 6.7EPSS 0.13%

Does this matter?

Lower severity and a low EPSS score (0.13%). Track it; it rarely justifies an emergency change on its own.

Description

Insufficient sanitization of volume paths in Netatalk 3.1.0 through 4.4.2 allows a local privileged user to inject OS commands and execute arbitrary code via a crafted volume path.

CVSS 3.1: 6.7 MEDIUMCVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
EPSS: 0.13% probability · 3th percentile
CISA KEV: Not listed
Weakness: CWE-78
Source: 33c584b5-0579-4c06-b2a0-8d8329fcab9c

References

https://netatalk.io/security/CVE-2026-44076

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.