The flaw exists in Netatalk 2.1.0 through 4.4.2, where extended attribute (EA) path components are not fully sanitized. A remote authenticated attacker can craft EA names containing path traversal sequences, leading the server to write files outside the intended metadata namespace. This is a classic directory traversal weakness (CWE‑22) that enables arbitrary file modification beyond the allowed scope, potentially compromising system data integrity and confidentiality.

Netatalk (Netatalk) is affected in all releases from version 2.1.0 up to and including 4.4.2.

The CVSS score of 7.6 signals a high severity vulnerability. EPSS is not available, and the vulnerability is not listed in CISA's KEV catalog. Based on the description and the fact that Netatalk is a network file‑sharing service, it is inferred that the attack vector is remote. A remote authenticated attacker could craft a special EA request containing path traversal sequences that cause the server to write files outside the intended metadata namespace, potentially exposing sensitive data or enabling arbitrary file modification.