Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
8.8
CVE-2026-44047: Debian Linux: Unauthenticated File Access in Package Manager
CVE-2026-44047 · published 5 months ago
Summary
A security issue in the Debian package manager can allow an attacker to access and modify system files without being authenticated. This could potentially allow unauthorized access to sensitive data or system settings. Debian users should update their package manager to the latest version to fix this issue.
What to do
- Update debian netatalk to version 4.2.3~ds-1+deb13u2.
- Update debian netatalk to version 4.4.3~ds-1.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| Ubuntu:Pro:14.04:LTS | canonical | netatalk | All versions |
| Ubuntu:Pro:16.04:LTS | canonical | netatalk | All versions |
| Ubuntu:Pro:18.04:LTS | canonical | netatalk | All versions |
| Ubuntu:Pro:20.04:LTS | canonical | netatalk | All versions |
| Ubuntu:Pro:22.04:LTS | canonical | netatalk | All versions |
| Ubuntu:Pro:24.04:LTS | canonical | netatalk | All versions |
| Ubuntu:25.10 | canonical | netatalk | All versions |
| Ubuntu:26.04:LTS | canonical | netatalk | All versions |
| Debian:11 | debian | netatalk | All versions |
| Debian:13 | debian | netatalk |
< 4.2.3~ds-1+deb13u2 Fix: upgrade to 4.2.3~ds-1+deb13u2
|
| Debian:14 | debian | netatalk |
< 4.4.3~ds-1 Fix: upgrade to 4.4.3~ds-1
|
Original advisory text
An SQL injection vulnerability in the MySQL CNID backend in Netatalk 3.1.0 through 4.4.2 allows a remote authenticated attacker to obtain unauthorized access to data, modify data, or cause a denial...
An SQL injection vulnerability in the MySQL CNID backend in Netatalk 3.1.0 through 4.4.2 allows a remote authenticated attacker to obtain unauthorized access to data, modify data, or cause a denial of service.
References
- https://security-tracker.debian.org/tracker/CVE-2026-44047 Vendor Advisory
- https://www.cve.org/CVERecord?id=CVE-2026-44047 Third Party Advisory
- https://ubuntu.com/security/CVE-2026-44047 Third Party Advisory
- https://netatalk.io/security/CVE-2026-44047 Third Party Advisory
Internet-facing
14 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker full control
Type
CWE-89SQL Injection
Timeline
Published21 May 2026
Updated4 Nov 2026
First seen14 May 2026
Track software like this
Free during beta