CVE-2026-44072 system() after failed chdir()
A local privileged user can execute unintended commands or disrupt service due to improper error handling after a failed directory change.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-44072?
CVE-2026-44072 is a low-severity command injection vulnerability in Netatalk, published on 21 May 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
Netatalk 2.2.1 through 4.4.2 calls system() after a failed chdir() without properly handling the error condition, which allows a local privileged user to execute unintended commands or cause a minor service disruption under specific conditions.
Weakness: CWE-78
Which versions are affected by CVE-2026-44072?
How do I fix CVE-2026-44072?
Apply the vendor's patch.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2026-44072 being exploited?
There is no known exploitation of CVE-2026-44072 in the wild and no public exploit code.
Sources
Also known as DEBIAN-CVE-2026-44072, GHSA-hpgh-hjhq-qx82, UBUNTU-CVE-2026-44072.