# CVE-2026-44068: Netatalk path traversal in extended attribute handling

Source: https://junglewise.ai/threats/cve-2026-44068-netatalk-path-traversal-in-extended-attribute-handling  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-21. Updated: 2026-05-21  
License: CC BY 4.0 with a link back

CVE-2026-44068 · Severity: high · CVSS 7.6 · Published 2026-05-21

Netatalk, an open-source implementation of the Apple Filing Protocol (AFP) used to share files with macOS clients, contains a security flaw in how it handles file metadata. An authorized user could bypass directory restrictions to create, modify, or delete files they should not have access to. This could lead to unauthorized data modification or loss of system integrity on the file server.

Technologies: [Netatalk](https://junglewise.ai/threats/technologies/netatalk). Vendors: [Netatalk](https://junglewise.ai/threats/vendors/netatalk).

## Quick answers

**Is CVE-2026-44068 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-44068 being exploited in the wild.

**How severe is CVE-2026-44068?** High severity, with a CVSS score of 7.6, published 21 May 2026.

**Which products and versions are affected?** Netatalk 2.1.0 through 4.4.2.

**Is there a fix for CVE-2026-44068?** A patch was published on 2026-05-21: Fixed in version 4.4.3 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-44068 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-44068?** Check whether you run Netatalk at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A path traversal vulnerability (CWE-22) exists in Netatalk versions 2.1.0 through 4.4.2 due to incomplete sanitization of extended attribute (EA) names when stored as AppleDouble files. When processing EA file operations, the software fails to consistently confine client-controlled names to the designated metadata namespace. An authenticated attacker with network access to the AFP service can exploit this to create, modify, remove, or change permissions of files on the underlying filesystem, limited by the permissions of the user account running the service. The issue is resolved in version 4.4.3.

## Affected products

- Netatalk Netatalk 2.1.0 through 4.4.2

## Timeline

- 2026-05-13: disclosed
- 2026-05-21: advisory: NVD publication date
- 2026-05-21: patched: Fixed in version 4.4.3

## References

- [https://netatalk.io/security/CVE-2026-44068](https://netatalk.io/security/CVE-2026-44068)

## Related threats

- [Netatalk afpd stack buffer overflow in deletedir()](https://junglewise.ai/threats/cve-2026-45698-netatalk-afpd-stack-buffer-overflow-in-deletedir)
- [Netatalk afpd stack buffer overflow in copydir()](https://junglewise.ai/threats/cve-2026-45699-netatalk-afpd-stack-buffer-overflow-in-copydir)
- [Netatalk TOCTOU race condition in ad_flush](https://junglewise.ai/threats/cve-2026-7837-netatalk-toctou-race-condition-in-ad-flush)
- [Netatalk missing break statement in DSI OpenSession](https://junglewise.ai/threats/cve-2026-44075-netatalk-missing-break-statement-in-dsi-opensession)
- [Netatalk incorrect calculation in ACL error handling](https://junglewise.ai/threats/cve-2026-44074-netatalk-incorrect-calculation-in-acl-error-handling)