Executive brief
Netatalk, an open-source implementation of the Apple Filing Protocol (AFP) used to share files with Apple computers, contains a minor security flaw in how it handles file metadata. Under very specific and difficult-to-replicate timing conditions, a remote attacker might be able to cause limited, unauthorized changes to file data. While the risk is considered low and the vendor has been unable to reproduce a full exploit, it represents a potential integrity risk to files stored on the server.
Technical details
A time-of-check time-of-use (TOCTOU) vulnerability exists in the ad_flush function of Netatalk versions 3.0.0 through 4.4.2. The issue stems from how AppleDouble metadata is flushed; the process changes the working directory and elevates privileges to root before applying metadata to the current directory ('.') by path. This creates a race condition where the underlying file or directory could be swapped between the time of the check and the time of the privileged operation. Although the vendor reported difficulty in reproducing the exploit, the implementation has been hardened to avoid path-based ambiguity. A patch is available, and the issue is addressed in version 4.5.0.
Affected products
- Netatalk Netatalk 3.0.0 - 4.4.2
Timeline
- 2026-05-13: disclosed: Initial disclosure date reported by vendor
- 2026-05-21: advisory: NVD publication date