Netatalk, a file‑sharing service, has a flaw where the OS function system() is called after a failed chdir() without properly handling the error. According to the updated description, this behavior enables a local privileged user to execute unintended commands or cause a minor service disruption under specific conditions. The weakness corresponds to OS command injection (CWE‑78). The impact is confined to the user running the Netatalk process and does not grant remote code execution or privilege escalation, which explains the low CVSS score.

The vulnerability exists in Netatalk versions 2.2.1 through 4.4.2. Netatalk is distributed by the Netatalk project and is typically deployed on Unix‑like servers that provide Apple file‑sharing services.

The CVSS score of 2.5 reflects a low risk level. EPSS data is unavailable, and the flaw is not listed in the CISA KEV catalog, indicating no known widespread exploitation. The vulnerability requires a local attacker to trigger a chdir() failure and subsequently influence the system() call, which typically demands specific input or conditions. Therefore, the likelihood of exploitation is low and the attack vector is inferred to be local.