An SQL injection vulnerability exists in the MySQL CNID backend of Netatalk versions 3.1.0 through 4.4.2. It permits a remote authenticated attacker to obtain unauthorized access to data, modify data, or cause a denial of service. The weakness is identified as CWE‑89, indicating improper input validation handling of SQL queries.

The vulnerability affects Netatalk installations using the MySQL CNID backend in the version range 3.1.0 to 4.4.2 inclusive. Users running these versions should be aware that the data stored by the CNID database can be compromised until the vendor releases a fix.

The CVSS score of 8.8 classifies this as a high severity issue. The EPSS score is currently unavailable, and the vulnerability does not appear in the CISA KEV catalog. Based on the description, the likely attack vector is a remote authenticated attacker accessing the Netatalk service over the network, requiring network connectivity to the affected machine. Exploitation would involve sending a crafted request that manipulates the SQL query within the CNID backend, potentially without needing any elevated privileges on the host.