# CVE-2026-44072: Netatalk improper directory handling during CNID cleanup

Source: https://junglewise.ai/threats/cve-2026-44072-netatalk-improper-directory-handling-during-cnid-cleanup  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-21. Updated: 2026-05-21  
License: CC BY 4.0 with a link back

CVE-2026-44072 · Severity: low · CVSS 3 · Published 2026-05-21

Netatalk is an open-source implementation of the Apple Filing Protocol (AFP) used to share files with Apple computers. A flaw in the database cleanup process could allow a highly privileged local user to cause the system to delete or modify files in the wrong directory if they can force a directory change to fail. The risk is considered low as it requires significant local access and specific environmental conditions to exploit.

Technologies: [Netatalk](https://junglewise.ai/threats/technologies/netatalk). Vendors: [Netatalk](https://junglewise.ai/threats/vendors/netatalk).

## Quick answers

**Is CVE-2026-44072 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-44072 being exploited in the wild.

**How severe is CVE-2026-44072?** Low severity, with a CVSS score of 3, published 21 May 2026.

**Which products and versions are affected?** Netatalk 2.2.1 through 4.4.2.

**Is there a fix for CVE-2026-44072?** A patch was published on 2026-05-21: Fixed in version 4.5.0 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-44072 attacked?** It is attacked with local access, in a software library.

**Am I affected by CVE-2026-44072?** Check whether you run Netatalk at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A vulnerability exists in the CNID (Catalog Node ID) database cleanup routine where the application continues to execute a shell command via system() even after a chdir() call fails. While the command itself is fixed and does not allow for arbitrary command injection, the failure to verify the working directory means the cleanup command may execute against files in an unintended location. Exploitation requires local access with high privileges (PR:H) and a high degree of complexity (AC:H) to manipulate the environment such that the directory change fails while the subsequent command still executes. This issue is resolved in Netatalk version 4.5.0.

## Affected products

- Netatalk Netatalk 2.2.1 through 4.4.2

## Timeline

- 2026-05-13: disclosed: Initial disclosure date
- 2026-05-21: advisory: NVD publication date
- 2026-05-21: patched: Fixed in version 4.5.0

## References

- [https://netatalk.io/security/CVE-2026-44072](https://netatalk.io/security/CVE-2026-44072)

## Related threats

- [Netatalk afpd stack buffer overflow in deletedir()](https://junglewise.ai/threats/cve-2026-45698-netatalk-afpd-stack-buffer-overflow-in-deletedir)
- [Netatalk afpd stack buffer overflow in copydir()](https://junglewise.ai/threats/cve-2026-45699-netatalk-afpd-stack-buffer-overflow-in-copydir)
- [Netatalk TOCTOU race condition in ad_flush](https://junglewise.ai/threats/cve-2026-7837-netatalk-toctou-race-condition-in-ad-flush)
- [Netatalk missing break statement in DSI OpenSession](https://junglewise.ai/threats/cve-2026-44075-netatalk-missing-break-statement-in-dsi-opensession)
- [Netatalk incorrect calculation in ACL error handling](https://junglewise.ai/threats/cve-2026-44074-netatalk-incorrect-calculation-in-acl-error-handling)