Netatalk 3.1.0 through 4.4.2 permits a local privileged user to craft a volume path containing shell metacharacters that the server later interprets and executes. This is a classic operating‑system command injection classified as CWE‑78. The flaw allows the attacker to run arbitrary commands with the privileges of the Netatalk process, potentially enabling full system compromise if the process runs with elevated rights.

The affected product is Netatalk, a server implementation of the AppleTalk networking protocol. All released releases from 3.1.0 up to and including 4.4.2 are vulnerable; it is not confirmed whether later versions fix the issue.

The CVSS score of 6.7 reflects moderate severity. No EPSS data is available, and the vulnerability is not listed in the CISA KEV catalog. An attacker must be a local user with the ability to create or modify a volume name or path; the server then parses that input and invokes the shell, executing injected commands. Because the attack requires a local privileged user, it does not allow remote exploitation, but it still permits arbitrary code execution with the service’s privileges.