CVE-2026-44068: EA path traversal via incomplete sanitization
Incomplete sanitization of extended attribute (EA) path components in Netatalk 2.1.0 through 4.4.2 allows a remote authenticated attacker to write to files outside the intended metadata namespace via crafted EA names.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
alpine/netatalkto a version that resolves this vulnerability.Fixed in 4.4.3-r0
Event History
Frequently Asked Questions
What is the severity of CVE-2026-44068?
The severity of CVE-2026-44068 is rated high with a score of 7.6.
How do I fix CVE-2026-44068?
To fix CVE-2026-44068, upgrade to Netatalk version 4.4.3 or later.
What vulnerability does CVE-2026-44068 exploit?
CVE-2026-44068 exploits a path traversal vulnerability due to incomplete sanitization in Netatalk.
Which versions of Netatalk are affected by CVE-2026-44068?
Netatalk versions 2.1.0 through 4.4.2 are affected by CVE-2026-44068.
What are the potential impacts of CVE-2026-44068?
CVE-2026-44068 can lead to information disclosure by allowing unauthorized access to files outside the intended directory.