Executive brief
Netatalk, an open-source implementation of the Apple Filing Protocol (AFP) used for file sharing, contains a security flaw in how it handles LDAP directory lookups. An attacker with basic network access could potentially manipulate directory queries to bypass certain authorization checks or cause lookup errors. While this could lead to unauthorized access to information, it does not allow for remote code execution and is considered difficult to exploit in practice.
Technical details
An LDAP filter injection vulnerability exists in Netatalk versions 2.1.0 through 4.4.2 due to improper neutralization of special elements used in LDAP queries (CWE-90). Specifically, LDAP search filters interpolate unescaped name values influenced by the client. In deployments utilizing LDAP-backed Access Control Lists (ACLs) or identity mapping, an authenticated attacker can craft malicious inputs to manipulate the resulting LDAP query. This can result in authorization bypass or identity lookup confusion. The attack requires low privileges but has high complexity (AC:H) due to the specific deployment requirements and input constraints. The issue is resolved in version 4.5.0 or by applying a specific security patch.
Affected products
- Netatalk Netatalk 2.1.0 through 4.4.2
Timeline
- 2026-05-13: disclosed: Initial disclosure date by Netatalk team
- 2026-05-21: advisory: NVD publication date
- 2026-05-21: patched: Fixed in version 4.5.0